Qualys

---
name: qualys
description: "Expert agent for Qualys VMDR, TotalCloud, and the Qualys Cloud Platform. Covers Cloud Agent, scanner appliances, QQL, asset groups, TruRisk scoring, VMDR workflows, TotalCloud CNAPP, WAS, and Policy Compliance. WHEN: \"Qualys\", \"VMDR\", \"QQL\", \"Qualys Cloud Agent\", \"TruRisk\", \"TotalCloud\", \"Qualys scanner appliance\", \"Qualys CSAM\", \"Qualys WAS\", \"CSAM\"."
license: MIT
---

# Qualys

This skill covers the Qualys Cloud Platform and its modules: VMDR (Vulnerability Management Detection Response), TotalCloud (CNAPP), WAS (Web Application Scanning), Policy Compliance (PC), Certificate View, CSAM (Cyber Security Asset Management / External Attack Surface), and Container Security. It has deep expertise in Cloud Agent deployment, scanner appliance management, QQL query language, and TruRisk scoring.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Scanner deployment / architecture** -- Load `references/architecture.md`
   - **VMDR workflows** -- Apply VMDR guidance below, reference architecture.md
   - **Asset management / QQL** -- Apply QQL and asset grouping guidance
   - **TotalCloud / cloud security** -- Load `references/architecture.md` for TotalCloud details
   - **Policy compliance** -- Apply compliance auditing guidance
   - **TruRisk scoring** -- Apply TruRisk guidance below

2. **Identify module context** -- Which Qualys module is in scope? VMDR, TotalCloud, WAS, PC, CSAM? The platform is modular -- capabilities and configuration differ by module.

3. **Load context** -- Read the relevant reference file.

4. **Analyze** -- Apply Qualys-specific reasoning. Asset tagging, Cloud Agent health, and QQL queries are the core operational levers.

5. **Recommend** -- Provide actionable guidance with Qualys module paths, API endpoints, or QQL examples.

## Product Family Overview

| Module | Description |
|---|---|
| **VMDR** | Core vulnerability management: detect, prioritize, remediate |
| **CSAM** | Cyber Security Asset Management -- asset inventory, unknown assets, external attack surface |
| **TotalCloud** | CNAPP: CSPM + CWPP + CIEM + SCA for cloud environments |
| **WAS** | Web Application Scanning -- DAST for web apps and APIs |
| **Policy Compliance (PC)** | Configuration auditing against CIS, DISA STIG, custom policies |
| **Container Security (CS)** | Container image and registry scanning |
| **Patch Management (PM)** | Integrated patch deployment (Windows/Linux) |
| **Certificate View (CV)** | TLS/SSL certificate discovery and expiry tracking |
| **EDR** | Endpoint Detection and Response |
| **FIM** | File Integrity Monitoring |

## Core Concepts

### TruRisk Score

Qualys's proprietary risk score for assets and vulnerabilities.

**Asset TruRisk Score (1-1000):**
- Calculated per asset based on all open vulnerabilities
- Factors: Vulnerability CVSS scores, QDS (Qualys Detection Score), EPSS, CISA KEV presence, asset criticality
- Higher = more risk
- Used for portfolio-level risk trending and peer benchmarking

**QDS (Qualys Detection Score):**
- Per-detection risk score
- Combines CVSS base, temporal metrics, EPSS, CISA KEV, threat intelligence enrichment
- Range: 0-100
- Replaces raw CVSS as the operational prioritization metric

**Prioritization workflow:**
1. KEV entries: Immediate action (any asset, any environment)
2. QDS 90-100: Treat as critical (patch within 24-72h for Tier 1 assets)
3. QDS 70-89: High priority (patch within 7-14 days)
4. QDS < 70: Standard SLA-based remediation

### Asset Groups vs. Asset Tags

**Asset Groups (legacy, static):**
- Static IP-based groupings
- Created by network ranges or individual IPs
- Used for scan targeting and access control
- Limited scalability for dynamic environments

**Asset Tags (recommended, dynamic):**
- Dynamic rules-based tagging
- Tag assets automatically based on OS, hostname, IP range, cloud metadata, installed software
- Tags power VMDR dashboards, scan policies, and reporting
- Example tag rules:
  - `os.name:"Windows Server"` --> tag as `Windows-Server`
  - `network.address.cidr:"10.10.0.0/16"` --> tag as `Corporate-Network`
  - `cloud.provider:"AWS"` --> tag as `AWS-Cloud`
  - `asset.name:*-prod-*` --> tag as `Production`

**Tag hierarchy:**
- Parent/child tag relationships
- Parent tag auto-applies to all child-tagged assets
- Example: `Cloud` > `AWS` > `AWS-Production`

### QQL (Qualys Query Language)

QQL is Qualys's search syntax for filtering assets and vulnerabilities across modules.

**QQL syntax structure:**
```
field_name:value
field_name:("value1" OR "value2")
field_name:[range_start..range_end]
NOT field_name:value
(condition1) AND (condition2)
```

**Common asset QQL examples:**
```qql
# Find all Windows servers
os.name:"Windows Server"

# Find internet-facing assets with open critical vulns
tags.name:"Internet-Facing" AND vulnerabilities.severity:5

# Find assets not scanned in 30 days
lastScanDate:[now-30d..now-1d]

# Find AWS EC2 instances in production
cloud.provider:"AWS" AND cloud.service:"EC2" AND tags.name:"Production"

# Find assets with specific CVE
vulnerabilities.cveIds:"CVE-2021-44228"

# Find assets with no recent agent check-in
agentLastActivityDate:[now-90d..now-31d]
```

**Common vulnerability QQL examples:**
```qql
# Critical vulns on internet-facing assets
severity:5 AND asset.tags.name:"Internet-Facing"

# CISA KEV vulns (any severity)
vulnerabilities.isKev:true

# High EPSS vulns (probability > 0.1)
vulnerabilities.epss:[0.1..1.0]

# Vulns older than 90 days (overdue)
vulnerabilities.firstFoundDate:[now-365d..now-90d] AND severity:[3..5]

# Vulns matching specific QID range
qid:[90001..90999]
```

## VMDR Workflows

### VMDR Four-Step Process

1. **Discover** -- Find all assets (Cloud Agent, scanner appliances, API)
2. **Detect** -- Identify vulnerabilities on discovered assets
3. **Prioritize** -- Use TruRisk/QDS/KEV to focus remediation effort
4. **Remediate** -- Track fixes through Qualys PM integration or ITSM

### Setting Up VMDR for a New Environment

**Step 1: Deploy Cloud Agents**
```bash
# Download agent installer from Qualys subscription portal
# Linux (RPM):
sudo rpm -ivh qualys-cloud-agent.rpm
sudo /usr/local/qualys/cloud-agent/bin/qualys-cloud-agent.sh ActivationId=XXXX CustomerId=YYYY

# Windows:
msiexec /i QualysCloudAgent.msi CustomerId="YYYY" ActivationId="XXXX" /qn
```

**Step 2: Deploy Scanner Appliances**
- Download VA (Virtual Appliance) from Qualys portal
- Deploy in VMware, Hyper-V, or physical hardware
- Assign to subscription, configure network
- Set scanner appliance "friendly name" for identification

**Step 3: Create Asset Tags**
- Auto-tag rules for your environment (cloud, on-prem, OS type, BU)
- Business unit tags for ownership and reporting

**Step 4: Create Scan Options Profile**
- Authentication: Windows/Unix/database credentials
- Performance: adjust concurrent threads, timeout
- Vulnerability: Include/exclude QID lists, discovery options

**Step 5: Create Option Profile and Scan Schedule**
- Option Profile: combines scan settings, authentication, options
- Schedule: set recurrence, target (tags or IPs), scanner assignment

### Remediation Tracking in VMDR

**Remediation module:**
- Create Remediation Tickets manually or auto-create from detection
- Assign tickets to asset owners (by tag, user, or business unit)
- Track: Assigned, Open, Ignored, Fixed, Re-Opened
- Integration: ServiceNow, Jira, SNOW VR module

**Patch Management integration:**
- Qualys PM module: deploy patches directly from VMDR workflow
- Windows and Linux patching through Cloud Agent (no separate agent)
- Patch job created from VMDR findings: "Patch all Critical findings on tag Production"
- Pre/post scan: verify vulnerabilities closed after patching

**Flow:**
```
Detection --> QDS-based prioritization --> Create remediation ticket
--> Assign to IT team --> Patch deployed (SCCM/Qualys PM/manual)
--> Re-scan (Cloud Agent continuous or targeted rescan)
--> Ticket closed on verified remediation
```

## Cloud Agent Deep Dive

**Agent assessment modes:**
- **Interval Scan:** Agent runs full assessment on configurable schedule (default: every 4 hours)
- **Continuous Monitoring:** Event-based assessment when new software installed or config changes
- **On-Demand:** Trigger immediate scan from Qualys portal

**Agent log locations:**
- Linux: `/var/log/qualys/qualys-cloud-agent.log`
- Windows: `C:\ProgramData\Qualys\QualysAgent\logs\`

**Troubleshooting agent connectivity:**
- Agent connects to `qualysapi.qualys.com` (or platform-specific hostname) on port 443
- Check proxy settings if agent is behind HTTP proxy
- Agent activation requires valid ActivationId and CustomerId

**Agent health monitoring:**
- Monitor via Qualys portal: Assets > Host Assets > filter by "Agent Status: Not Connected"
- QQL to find stale agents: `agentStatus.lastCheckedIn:[now-90d..now-1d]`
- Common issues: disk full, outdated agent version, connectivity blocked

## TotalCloud (CNAPP)

### TotalCloud Architecture

TotalCloud is Qualys's Cloud Native Application Protection Platform providing:
- **CSPM** (Cloud Security Posture Management) -- misconfiguration detection
- **CWPP** (Cloud Workload Protection) -- runtime protection for cloud workloads
- **CIEM** (Cloud Identity Entitlement Management) -- overprivileged IAM
- **SCA** (Software Composition Analysis for cloud)

**Supported cloud providers:**
- AWS (EC2, ECS, EKS, Lambda, RDS, S3, IAM, and 200+ services)
- Azure (VMs, AKS, SQL, Storage, Key Vault, and 150+ services)
- GCP (GCE, GKE, Cloud SQL, Cloud Storage, IAM, and 100+ services)

**Connection methods:**
- AWS: CloudFormation stack deploys read-only IAM role
- Azure: Service principal with Reader role on subscriptions
- GCP: Service account with Viewer role on projects
- No agent required -- API-based assessment

### CSPM Policies

- 1,000+ built-in policies mapping to CIS, NIST, PCI DSS, SOC 2, HIPAA, custom
- Policy severity: Critical / High / Medium / Low / Informational
- Evaluate misconfigurations: public S3 buckets, unrestricted security groups, unencrypted volumes
- Compliance posture score: % controls passing across all connected accounts

**Custom policies (FlexPolicies):**
- Define custom CSPM rules using JSON policy templates
- Target specific resource types, attributes, and conditions
- Example: "Flag any EC2 instance with metadata endpoint IMDSv1 enabled"

### CIEM (Identity Analytics)

- Identify overprivileged IAM roles, users, and service accounts
- "Effective permissions" analysis: what can each identity actually do vs. what it's assigned
- Highlight: Unused permissions (granted but never exercised in 90 days)
- Findings: "This Lambda function has `s3:*` but only ever calls `s3:GetObject`"
- Remediation: Least-privilege policy recommendations (right-size to actual usage)

## WAS (Web Application Scanning)

Qualys WAS is a DAST module for web application and API security testing.

**WAS capabilities:**
- Crawls and audits web applications for OWASP Top 10 and more
- API scanning (Swagger/OpenAPI, Postman collection, manual API)
- Authentication: form-based, OAuth 2.0, SAML, API keys
- Selenium script recording for multi-step authentication flows
- Scan scheduling: on-demand, scheduled, CI/CD triggered

**WAS scan types:**
- **Discovery scan:** Map all URLs and pages (no vulnerability testing)
- **Vulnerability scan:** Full DAST assessment
- **API scan:** Target REST/SOAP API endpoints specifically

**Integration with VMDR:**
- WAS findings flow into VMDR vulnerability dashboard
- Web application vulns appear alongside infrastructure vulns
- Unified TruRisk score across web app + infrastructure findings

## Policy Compliance (PC) Module

**Supported benchmarks:**
- CIS Benchmarks (Level 1, Level 2) for OS, cloud, databases
- DISA STIGs for DoD environments
- PCI DSS, HIPAA, NIST 800-53, ISO 27001
- Custom policies (Qualys Control Library)

**PC vs. VM scans:**
- Use separate scan policies for compliance (PC option profile) vs. vulnerability scanning (VM option profile)
- Compliance scans check configuration settings; VM scans check for missing patches and software vulns

**Custom controls:**
Qualys supports custom compliance checks via the Control Library:
- Shell command execution (Linux)
- Registry checks (Windows)
- File content checks
- WMI queries

## Qualys API

Qualys provides REST APIs for all modules.

**API authentication:**
```bash
# Basic auth (username/password)
curl -u "user:password" "https://qualysapi.qualys.com/api/2.0/fo/scan/"

# Session token (preferred)
curl -d "action=login&username=user&password=pass" \
  "https://qualysapi.qualys.com/api/2.0/fo/session/"
```

**Key API endpoints:**
```
# Asset management
GET /api/2.0/fo/asset/host/          # Host list
GET /api/2.0/fo/asset/tag/           # Tag list
POST /api/2.0/fo/asset/host/vm/      # Purge/update assets

# Vulnerability management
GET /api/2.0/fo/knowledge_base/      # Download vuln KB
POST /api/2.0/fo/scan/               # Launch scan
GET /api/2.0/fo/scan/                # List scans
GET /api/2.0/fo/report/              # Export reports

# Detections
POST /api/2.0/fo/asset/host/vm/detection/?action=list  # Detections per host
```

**Qualys API v2 (VMDR):**
- Newer REST API with JSON responses
- Better for modern integrations

**Common automation use cases:**
- Sync asset inventory from CMDB to Qualys tags
- Export detections to SIEM (Splunk, Sentinel) via API
- Auto-create ServiceNow tickets for new critical findings
- CI/CD scanning: trigger WAS scan on new app deployment

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/architecture.md` -- Cloud Agent internals, scanner appliance deployment, QQL reference, asset groups, TotalCloud CNAPP architecture.