Skip to main content

Qualys

Visualize Qualys scanners and findings, monitor findings and changes through queries and alerts.

Installation​

This integration connects to the Qualys API using a username and password. The Qualys user must have the Manager role, or a custom role with equivalent read access to the modules you want to ingest. The built-in Reader role is not sufficient — it does not grant access to host detection data. See the Qualys VM and PA API documentation for details.

note

If you use Container Security ingestion, the Qualys user must also have the Container Security module enabled and the CS API Access permission assigned in your Qualys account.

If you use Certificates ingestion, your subscription must include Certificate View, and the Qualys user's role must have API Access plus the CERTVIEW API Access permission (Administration > Role Management > edit the role > Permissions > Modules: Certificate View). Without it, the Fetch Certificates step fails with Unauthorized.

Configuration in JupiterOne​

To add the Qualys integration, navigate to Integrations in JupiterOne and select Qualys. Click New Instance to begin.

Choose an authentication method: Basic, where you enter the Qualys password in JupiterOne, or CyberArk Central Credential Provider, where the integration retrieves it from your CyberArk vault on every run.

Basic​

  • Qualys Username — the username of the Qualys account used for API access. Must belong to a non-test account user.
  • Qualys Password — the password for the Qualys user account.
  • API URL — your Qualys platform API URL (for example, https://qualysapi.qg3.apps.qualys.com). See Identify your Qualys platform to find the correct URL for your account.

CyberArk Central Credential Provider​

Use this method to rotate and manage the Qualys password in CyberArk instead of in JupiterOne. Before each run, and when you test credentials, the integration calls the CCP REST web service (GET <CCP URL>/<web service>/api/Accounts) with your application ID, safe, folder and object, then uses the returned account to call Qualys. JupiterOne does not store the password.

Before you configure the instance, in CyberArk:

  1. Store the Qualys account in a safe.
  2. Create an application ID for JupiterOne and give it access to that safe.
  3. Allow JupiterOne to call CCP for that application. CCP authenticates callers by allowed machines, by client certificate, or both.
    • If the integration runs in JupiterOne's cloud, the CCP web server must be reachable over HTTPS from the internet, and the allowed machines must include JupiterOne's egress IP addresses. Contact JupiterOne support to get them. A client certificate is recommended.
    • If the integration runs on a collector in your network, the call comes from the collector host, so allow that machine.

Then provide:

  • API URL — your Qualys platform API URL, as for Basic.

  • CCP URL — the base HTTPS URL of your CCP web server, for example https://ccp.example.com. Loopback and link-local addresses are rejected.

  • CCP Web Service Name (optional) — leave empty for the default, AIMWebService.

  • Application ID — the CyberArk application ID allowed to retrieve the account.

  • Safe — the safe that holds the Qualys account.

  • Folder (optional) — leave empty for the safe root.

  • Object — the name of the Qualys account object in the safe.

  • Qualys Username (optional) — only needed when the vaulted account has no user name. The user name stored in CyberArk takes precedence.

  • Client Certificate and Client Certificate Private Key (optional) — PEM certificate and key, if your application authenticates callers by certificate. Provide both or neither.

  • CCP CA Certificate (optional) — PEM CA certificate, if the CCP server certificate is issued by a private CA.

CCP does not accept the characters +, & or % in the application ID, safe, folder or object name.

Click Create to finalize the instance.

Data Volume Configuration​

Control how much data is ingested from Qualys.

Ingestion Windows​

FieldDescriptionDefaultOptions
Host scan age FilterProcess only scans completed within this many days.7Any number
Findings age FilterProcess only findings identified or updated within this many days.7Any number
Images Ingestion WindowProcess only container images updated within this many days.9090, 180, 275, 365
Fixed Host Findings Age Filter (Days)When Fixed status is selected below, only fixed host findings within this age window are ingested. Has no effect unless Fixed is selected under Host Finding Statuses.—30, 90, 180, 365
Software Installed Since (Days)Limit installed software ingestion to items installed within this many days.—30, 90, 180, 365

Host Detection Filtering Options​

FieldDescriptionDefault
Host Finding SeveritiesLimit host findings to these severity levels (1–5, comma-separated).3, 4, 5
Host Finding TypesLimit host findings to these detection types. Valid values: Info, Potential, Confirmed.Potential, Confirmed
Host Finding StatusesLimit host findings to these statuses. Options: New, Active, Re-Opened, Fixed.New, Active, Re-Opened
Include Detection ResultsWhen enabled, includes the first 300 bytes of raw detection result data for each host finding (such as file paths). This significantly increases run time.Disabled
Include Only Asset TagsRestrict host detection ingestion to hosts that match these tag names or IDs (comma-separated). Leave empty to ingest all hosts.—

Web Application Scan Options​

FieldDescriptionDefault
Web Application IDsOnly ingest web applications and findings for these application IDs (comma-separated). Leave empty to ingest all scanned web applications.—

Container Image Options​

FieldDescriptionDefault
Container images Finding SeveritiesLimit container image vulnerability findings to these severity levels (1–5, comma-separated).3, 4, 5
Skip Unassociated Container ImagesWhen enabled, skips container images that are not associated with any running or stopped container.Disabled

Compliance Options​

FieldDescriptionDefault
Policy IDsOnly ingest compliance findings for these policy IDs (comma-separated). Leave empty to ingest all policies.—
Compliance Finding StatusesLimit compliance finding ingestion to these statuses. Options: Passed, Failed, Error, Exception. Leave empty to ingest all statuses.—
Include EvidenceWhen enabled, includes evidence data in compliance findings. This significantly increases run time.Disabled
Include Cause of FailureWhen enabled, includes detailed cause-of-failure information in compliance findings. This significantly increases run time.Disabled

Installed Software Options​

FieldDescriptionDefault
Software TypesLimit installed software ingestion to these types. Options: Application, Unknown, Others.Application
Authorization StatusFilter installed software by authorization status. Options: Authorized, Not Reviewed, Blacklisted. Leave empty to include all.—

Troubleshooting​

If the integration fails with authorization errors, confirm that the Qualys user has the Manager role (or an equivalent custom role with API access). Note that a successful HTTP 200 response does not always mean access was granted — some Qualys endpoints return 200 with an UNAUTHORIZED body when the user lacks the required module permission. Check the integration job logs for UNAUTHORIZED error messages to identify which endpoint is failing.

If you use the CyberArk Central Credential Provider method and the job fails before any step runs, the error names the CyberArk error code (for example APPAP...) when CCP returned one:

  • Rejected the request (HTTP 401 or 403): the application ID does not allow this caller. Check the allowed machines or client certificate, and that the application has access to the safe.
  • Found no matching account (HTTP 404): check the safe, folder, object and web service name.
  • Could not reach the CyberArk Central Credential Provider: the CCP server does not accept connections from where the integration runs, or its certificate is not trusted. For a private CA, set CCP CA Certificate.

The integration retrieves the password once, at the start of each run. If CyberArk rotates the password while a run is in progress, the rest of that run fails with Qualys authentication errors and the next run picks up the new password. Schedule rotation outside the integration's polling window when you can.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.