Skip to main content

Qualys

Visualize Qualys scanners and findings, monitor findings and changes through queries and alerts.

Installation​

This integration connects to the Qualys API using a username and password. The Qualys user must have the Manager role, or a custom role with equivalent read access to the modules you want to ingest. The built-in Reader role is not sufficient — it does not grant access to host detection data. See the Qualys VM and PA API documentation for details.

note

If you use Container Security ingestion, the Qualys user must also have the Container Security module enabled and the CS API Access permission assigned in your Qualys account.

Configuration in JupiterOne​

To add the Qualys integration, navigate to Integrations in JupiterOne and select Qualys. Click New Instance to begin.

Creating an instance requires the following:

  • Qualys Username — the username of the Qualys account used for API access. Must belong to a non-test account user.
  • Qualys Password — the password for the Qualys user account.
  • API URL — your Qualys platform API URL (for example, https://qualysapi.qg3.apps.qualys.com). See Identify your Qualys platform to find the correct URL for your account.

Click Create to finalize the instance.

Data Volume Configuration​

Control how much data is ingested from Qualys.

Ingestion Windows​

FieldDescriptionDefaultOptions
Host scan age FilterProcess only scans completed within this many days.7Any number
Findings age FilterProcess only findings identified or updated within this many days.7Any number
Images Ingestion WindowProcess only container images updated within this many days.9090, 180, 275, 365
Fixed Host Findings Age Filter (Days)When Fixed status is selected below, only fixed host findings within this age window are ingested. Has no effect unless Fixed is selected under Host Finding Statuses.—30, 90, 180, 365
Software Installed Since (Days)Limit installed software ingestion to items installed within this many days.—30, 90, 180, 365

Host Detection Filtering Options​

FieldDescriptionDefault
Host Finding SeveritiesLimit host findings to these severity levels (1–5, comma-separated).3, 4, 5
Host Finding TypesLimit host findings to these detection types. Valid values: Info, Potential, Confirmed.Potential, Confirmed
Host Finding StatusesLimit host findings to these statuses. Options: New, Active, Re-Opened, Fixed.New, Active, Re-Opened
Include Detection ResultsWhen enabled, includes the first 300 bytes of raw detection result data for each host finding (such as file paths). This significantly increases run time.Disabled
Include Only Asset TagsRestrict host detection ingestion to hosts that match these tag names or IDs (comma-separated). Leave empty to ingest all hosts.—

Web Application Scan Options​

FieldDescriptionDefault
Web Application IDsOnly ingest web applications and findings for these application IDs (comma-separated). Leave empty to ingest all scanned web applications.—

Container Image Options​

FieldDescriptionDefault
Container images Finding SeveritiesLimit container image vulnerability findings to these severity levels (1–5, comma-separated).3, 4, 5
Skip Unassociated Container ImagesWhen enabled, skips container images that are not associated with any running or stopped container.Disabled

Compliance Options​

FieldDescriptionDefault
Policy IDsOnly ingest compliance findings for these policy IDs (comma-separated). Leave empty to ingest all policies.—
Compliance Finding StatusesLimit compliance finding ingestion to these statuses. Options: Passed, Failed, Error, Exception. Leave empty to ingest all statuses.—
Include EvidenceWhen enabled, includes evidence data in compliance findings. This significantly increases run time.Disabled
Include Cause of FailureWhen enabled, includes detailed cause-of-failure information in compliance findings. This significantly increases run time.Disabled

Installed Software Options​

FieldDescriptionDefault
Software TypesLimit installed software ingestion to these types. Options: Application, Unknown, Others.Application
Authorization StatusFilter installed software by authorization status. Options: Authorized, Not Reviewed, Blacklisted. Leave empty to include all.—

Troubleshooting​

If the integration fails with authorization errors, confirm that the Qualys user has the Manager role (or an equivalent custom role with API access). Note that a successful HTTP 200 response does not always mean access was granted — some Qualys endpoints return 200 with an UNAUTHORIZED body when the user lacks the required module permission. Check the integration job logs for UNAUTHORIZED error messages to identify which endpoint is failing.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.