Skip to main content

Qualys Vulnerability Management

Qualys Vulnerability Management (VM) is a vulnerability scanning tool that scans hosts and generates vulnerabilities against those hosts. You can bring these findings into Brinqa to construct a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Qualys Vulnerability Management and how to obtain that information from Qualys. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Qualys Vulnerability Management from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate Qualys Vulnerability Management with Brinqa:

  • API Server URL: The Qualys API Server URL. For information on how to determine your Qualys API URL, see Qualys documentation.

  • Username and Password: The username and password associated with the Qualys user, which must have permissions to log in to the API server and return data.

Create a Qualys user

To ensure the user account that the Qualys VM connector uses to access the Qualys server has the appropriate permissions, follow these steps.

  1. Log in to your organization's Qualys server.

  2. Navigate to Users, and then select the Users tab.

  3. Click New and select User. The New User dialog displays.

    Qualys VM New User

  4. Fill out the general information for the new user.

  5. Click User Role on the left menu.

    • From the User Role drop-down, select Reader.

    • Select GUI and API to enable API access, and leave Business Unit Unassigned.

      note

      GUI access allows the user to log in to the Qualys GUI (graphical user interface). After you create the new Qualys user, log in to the Qualys GUI using the new credentials. The system prompts the user to reset their password. The Qualys connector will not function until you complete the password reset.

      Qualys VM User Role settings

  6. Click Asset Groups.

    • From the Add asset groups drop-down, select All or only the asset groups the Qualys user needs access to.
  7. Click Permissions and select all of the available permissions.

  8. Click Options to modify the notification options as needed.

  9. Click Save.

The new Qualys user with appropriate permissions to retrieve data displays on the Qualys Users page.

If you do not wish to create a new Qualys user, you can leverage an existing user with the appropriate permissions.

note

If you do not have permissions to create a new Qualys user, contact your Qualys administrator. For additional information, see Qualys documentation.

Enable CVSS scoring in Qualys

To ensure that the Qualys VM connector accurately retrieves CVSS scoring information, including Temporal Scores, from your Qualys environment, you must enable a specific setting in Qualys. This setting is not enabled by default. To enable this setting, follow these steps:

  1. Log in to your organization's Qualys server.

  2. Navigate to Vulnerability Management > Reports.

  3. Click the Setup tab and then click CVSS.

    Qualys VM CVSS

    The CVSS Setup window displays.

  4. Click Enable CVSS Scoring and then click Save.

    Qualys VM enable CVSS scoring

Additional settings

The Qualys Vulnerability Management connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

  • Parallel requests: The maximum number of parallel API requests. The default setting is 2.

  • Maximum retries: The maximum number of times that the integration attempts to connect to the Qualys API before giving up and reporting a failure. The default setting is 5.

  • Request timeout (secs): The maximum time allotted, in seconds, before a request times out. The default setting is 120 seconds. Although it is not recommended, you can also enter zero (0) to disable timeouts.

Types of data to retrieve

The Qualys Vulnerability Management connector can retrieve the following types of data from the Qualys API:

Table 1: Data retrieved from Qualys

Connector ObjectRequiredMaps to Data Model
HostYesHost
VulnerabilityYesVulnerability
Vulnerability DefinitionYesVulnerability Definition
info

For detailed steps on how to view the data retrieved from Qualys VM in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Host

Table 2: Host attribute mappings

Source Field NameMaps to Attribute
accountIdLocal variable
availability zoneLocal variable
categories/asset categorycategories
first discoveredfirstSeen
getNamename
host.getAGENTSTATUSLocal variable
host.getARSFACTORS.getARSFORMULALocal variable
host.getASSETCRITICALITYSCORELocal variable
host.getASSETRISKSCORELocal variable
host.getASSETIDLocal variable
host.getCLOUDAGENTRUNNINGONLocal variable
host.getCLOUDPROVIDERLocal variable
host.getCLOUDPROVIDERTAGSLocal variable
host.getCLOUDRESOURCEIDinstanceId
host.getCLOUDSERVICELocal variable
host.getDNSDATA.getDOMAINLocal variable
host.getDNSDATA.getFQDNpublicDnsNames, privateDnsNames
host.getHARDWAREUUIDLocal variable
host.getIDuid
host.getIPpublicIpAddresses
host.getLASTVMAUTHSCANNEDDATELocal variable
host.getLASTVULNSCANDATETIMElastScanned, lastSeen
host.getNETBIOShostnames
host.getOSdescription
host.getOWNERLocal variable
host.getQGHOSTIDLocal variable
host.getTRACKINGMETHODLocal variable
host.getTRURISKSCORELocal variable
host.getTRURISKSCOREFACTORS().getTRURISKSCOREFORMULALocal variable
host.getASSETCRITICALITYSCORELocal variable
host.getARSFACTORS.getARSFORMULALocal variable
hostnameshostnames
host.getCLOUDPROVIDERTAGSLocal variable
host.getOSdescription
host.getNETBIOShostname
host.getDNSDATA.getDOMAINdomain
host.getLASTVMAUTHSCANNEDDATElastAuthScanned
host.getARSFACTORS.getARSFORMULAarsFormula
host.getDNSDATA.getDOMAINdomain
host.getOSoperatingSystem
host.getDNSDATA.getDOMAINdomain
instance idinstanceId
instance statestatus
instance typeLocal variable
ipv6Local variable
locationLocal variable
local hostnameprivateDnsNames
macLocal variable
nameLocal variable
networkLocal variable
os typeLocal variable
portLocal variable
private ipLocal variable
private ipv4Local variable
project idLocal variable
protocolLocal variable
public hostnamepublicDnsNames
public ipLocal variable
public ipv4publicIpAddresses
regionLocal variable
resource group nameLocal variable
scan typeLocal variable
security groupLocal variable
statestatus
subnetLocal variable
subscription idLocal variable
targetLocal variable
typeLocal variable
uuiduid
vm idinstanceId
zoneLocal variable
Vulnerability

Table 3: Vulnerability attribute mappings

Source Field NameMaps to Attribute
detection.getAFFECTEXPLOITABLECONFIGLocal variable
detection.getAFFECTRUNNINGKERNELLocal variable
detection.getAFFECTRUNNINGSERVICELocal variable
detection.getFIRSTFOUNDDATETIMEfirstFound
detection.getFIRSTREOPENEDDATETIMELocal variable
detection.getLASTFIXEDDATETIMElastFixed
detection.getLASTFOUNDDATETIMElastFound
detection.getLASTREOPENEDDATETIMELocal variable
detection.getLASTTESTDATETIMElastScanned
detection.getLASTUPDATEDATETIMEsourceLastModified
detection.getRESULTSresults
detection.getSTATUSstatus
detection.getTIMESFOUNDtimesFound
detection.getTIMESREOPENEDLocal variable
detection.getTYPELocal variable
host.getDNSpublicDnsNames
host.getIDtargets
host.getIPipAddresses
host.getNETBIOShostnames
host.getQGHOSTIDLocal variable
is disabledLocal variable
is ignoredLocal variable
mac addressmacAddresses
portport
protocolprotocol
severityseverity
serviceservice
sslLocal variable
status categorystatusCategory
typetype
uiduid
Vulnerability Definition

Table 4: Vulnerability Definition attribute mappings

Source Field NameMaps to Attribute
cvssv2.getAttackComplexitycvssV2AccessComplexity
cvssv2.getAvailabilitycvssV2AvailabilityImpact
cvssv2.getAuthenticationcvssV2Authentication
cvssv2.getAttackVectorcvssV2AttackVector
cvssv2.getConfidentialitycvssV2ConfidentialityImpact
cvssv2.getExploitabilitycvssV2Exploitability
cvssv2.getIntegritycvssV2IntegrityImpact
cvssv2.getReportConfidencecvssV2ReportConfidence
cvssv2.getRemediationLevelcvssV2RemediationLevel
cvssv2.getSeveritycvssV2Severity
cvssv3.getAttackComplexitycvssV3AccessComplexity
cvssv3.getAvailabilitycvssV3AvailabilityImpact
cvssv3.getAttackVectorcvssV3AttackVector
cvssv3.getConfidentialitycvssV3ConfidentialityImpact
cvssv3.getExploitabilitycvssV3ExploitCodeMaturity
cvssv3.getIntegritycvssV3IntegrityImpact
cvssv3.getPrivilegesRequiredcvssV3PrivilegesRequired
cvssv3.getReportConfidencecvssV3ReportConfidence
cvssv3.getRemediationLevelcvssV3RemediationLevel
cvssv3.getUserInteractioncvssV3UserInteraction
discovery.getREMOTELocal variable
getAffectedSoftware.vuln.getSOFTWARELISTaffected
getBugTracIds.vuln.getBUGTRAQLISTLocal variable
getComplianceTypes.vuln.getCOMPLIANCELISTLocal variable
getDiscoveryAuthTypes(discovery.getAUTHTYPELISTLocal variable
getExploits.vuln.getCORRELATIONexploits
getMalwares.vuln.getCORRELATIONmalware
getPCIReasons.vuln.getPCIREASONSLocal variable
getThreatIndicators.vuln.getTHREATINTELLIGENCELocal variable
getVendorReferences.vuln.getVENDORREFERENCELISTreferences
uiduid
vuln.getCATEGORYcategories
vuln.getCVSS.getBASEcvssV2BaseScore, cvssV3BaseScore
vuln.getCVSS.getTEMPORALcvssV2TemporalScore, cvssV3TemporalScore
vuln.getCVSS.getVECTORSTRINGcvssV2Vector, cvssV3Vector
vuln.getCONSEQUENCEsummary
vuln.getDIAGNOSISdescription
vuln.getLASTSERVICEMODIFICATIONDATETIMEsourceLastModified
vuln.getPATCHABLEpatchAvailable
vuln.getPUBLISHEDDATETIMEpublishedDate
vuln.getSEVERITYLEVELseverity, severityScore, sourceSeverity
vuln.getSOLUTIONrecommendation
vuln.getTITLEname
vuln.getVULNTYPELocal variable
note

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The Qualys VM connector supports the following operation options. See connector operation options for information about how to apply them.

Expand the sections below to view the supported operation options for each connector object:

Host

Table 5: Host operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
Hosthost_metadataall, azure, ec2, googleRetrieve host metadata for all cloud providers (Azure, EC2, Google) or only the specified cloud providers.Key: host_metadata Value: all. This key and value combination retrieves metadata for hosts from all your cloud providers.
ipsAny IP addresses or rangesYou can use this option to retrieve specific hosts from Qualys by the specified IP addresses. You can use either a comma-separated list or specify a range with a dash.Key: ips Value: 10.10.10.1-10.10.10.100. This key and value combination only retrieves hosts associated with the specified range of IP addresses.
note

For additional information on on the supported operation options and parameters, see Qualys documentation.

Vulnerability

Table 6: Vulnerability operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
Vulnerabilityarf_kernel_filter0, 1, 2, 3, 4You can use this option to filter vulnerabilities on Linux kernels. For additional information, see Qualys documentation.Key: arf_kernel_filter Value: 3. This key and value combination only retrieves exploitable kernel related vulnerabilities.
idsAny valid host ID or rangeYou can use this option to filter vulnerabilities by specific host IDs or ranges. Multiple host IDs or ranges can be specified as a comma-separated list. Specify a host ID range using a hyphen (for example: 190-400). For additional information, see Qualys documentation.Key: ids Value: 123,200-250. This key and value combination retrieves vulnerabilities for the specified host IDs or ranges.
ipsAny valid IP address or rangeYou can use this option to filter vulnerabilities by specific IP addresses or ranges. Multiple IP addresses or ranges can be specified as a comma-separated list. Specify an IP range using a hyphen (for example: 10.10.10.1-10.10.10.100). For additional information, see Qualys documentation.Key: ips Value: 10.10.10.1,10.10.10.5-10.10.10.10. This key and value combination retrieves vulnerabilities for the specified IP addresses or ranges.
qds_maxAny Qualys Detection Score (QDS) value from 1-100You can use this option to filter vulnerabilities with a QDS value less than equal to the specified value. For additional information on QDS scores, see Qualys documentation.Key: qds_max Value: 10. This key and value combination only retrieves vulnerabilities with a QDS value less than or equal to 10.
qds_minAny QDS value from 1-100You can use this option to filter vulnerabilities with a QDS value greater than or equal to the specified value. For additional information on QDS scores, see Qualys documentation.Key: qds_min Value: 90. This key and value combination only retrieves vulnerabilities with a QDS value greater than or equal to 90.
severities1, 2, 3, 4, 5You can use this option to filter vulnerabilities by their severity level. You can use a comma-separated list to retrieve multiple severity levels or a dash to retrieve a range of severity levels. For additional information on severity levels, see Qualys documentation.Key: severities Value: 4,5. This key and value combination only retrieves vulnerabilities with a severity level of 4 or 5.
show_qds0, 1You can use this option to determine whether the QDS is displayed in the output for each vulnerability record. Specify 1 to show the QDS value for each detection record. Specify 0 if you do not want to show the QDS value.Key: show_qds Value: 1. This key and value combination displays the QDS value for each vulnerability record.
statusActive, Fixed, New, Re-OpenedYou can use this option to filter vulnerabilities by their status. You can use a comma-separated list statuses. For additional information, see Qualys documentation.Key: status Value: Active,Re-Opened. This key and value combination only retrieves active and re-opened vulnerabilities.
note

For additional information on on the supported operation options and parameters, see Qualys documentation.

note

The option keys and values are case-sensitive as they are shown in this documentation

APIs

The Qualys VM connector uses the Qualys VM API v2. Specifically, it uses the following endpoints:

Table 7: Qualys VM API Endpoints

Connector ObjectAPI Endpoint
HostGET /api/2.0/fo/asset/host/
VulnerabilityGET /api/2.0/fo/asset/host/vm/detection
Vulnerability DefinitionPOST /api/2.0/fo/knowledge_base/vuln/

Changelog

The Qualys VM connector has undergone the following changes:

Table 8: Qualys VM connector changelog

VersionDescription
5.3.9Fixed the following data type mismatches:
  • Changed the ASSET_ID attribute type on the Host object from string to long.
  • Changed the QDS_SCORE attributes on the Vulnerability object from string to long.
5.3.8No change.
5.3.7No change.
5.3.6Fixed an issue where the Vulnerability Definition object sync was failing due to a NullPointerException error.
5.3.5Added a new additional setting to help prevent sync failures due to default timeout limits: Request timeout.
5.3.4Changed the ASSET_ID attribute type on the Host object from integer to string.
5.3.3No change.
5.3.2- Added support for Data lifecycle management to the Host and Vulnerability objects.
- Added the following attributes to the Host object:
  • HOST_NAMES
  • INSTANCE_ID
  • MAC_ADDRESSES
  • PUBLIC_DNS_NAMES
  • PUBLIC_IP_ADDRESSES
  • SERIAL_NUMBER
  • UID
- Added the PROVIDER_STATUS attribute to the Vulnerability object.
5.2.4Added the following attributes on the Host object so it can utilize the TruRisk attribute from Qualys:
  • AGENT_STATUS
  • CLOUD_AGENT_RUNNING_ON
  • FIRST_SEEN
  • HARDWARE_ID
  • LAST_ACTIVITY
  • LAST_RESTART_OR_BOOT
  • SERIAL_NUMBER
  • TRURISK_SCORE
  • TRURISK_SCORE_FORMULA
5.2.3Added the following attributes on the Vulnerability object to retrieve the Qualys Detection Score:
  • QDS_FACTORS
  • QDS_SCORE
  • QDS_SEVERITY
5.2.2Changed the SOURCE_SEVERITY attribute on the Vulnerability Definition object to SOURCE_SEVERITY_SCORE.
5.2.1Changed the SOURCE_SEVERITY attribute on the Vulnerability object to SOURCE_SEVERITY_SCORE.
5.1.11Added the NETWORK_ID attribute on the Host object.
5.1.10Updated dependencies.
5.1.8Added asset risk score (ARS) related operation options such as ars_max, ars_min, show_ars, and show_ars_factors for the Host connector object.
5.1.5Added checks for null Common Vulnerability Scoring System (CVSS) vectors.
5.1.3Updated to trim trailing spaces from the CVE IDs present in certain vulnerability definitions.
5.0.18Added a SEVERITY_SCORE attribute in the Vulnerability Definition object.
5.0.14Added UID as identifier for all connector objects.
5.0.13Replaced the CATEGORY attribute with CATEGORIES in the Vulnerability Definition object.
5.0.12Replaced the CATEGORY attribute with CATEGORIES in the Host object.
5.0.10Stopped using IP_ADDRESS as identifier for hosts or vulnerabilities.
5.0.4Replaced the Finding Definition object with Vulnerability Definition.
5.0.0Initial Integration+ release.