Qualys VMDR

Enterprise

runZero integrates with Qualys VMDR by importing data from the Qualys KnowledgeBase API.

Asset inventory

There is a column on the asset inventory page showing the count of vulnerabilities detected by Qualys for each asset. When a single asset is selected, the vulnerabilities table lists all the results related to that asset. The vulnerability count can be impacted by the type of vulnerability scan as well as the import settings selected.

Vulnerabilities table

The Vulnerabilities tab of the inventory lists all vulnerability results that have been imported from Qualys. The table lists every result, and selecting a result will take you to the page for the impacted asset.

Severity and risk scores

Qualys assigns all vulnerabilities a severity rating (Minimal, Medium, Serious, Critical, Urgent). runZero normalizes the severities shown in the vulnerability inventory to be consistent across the runZero Console.

runZero will also normalize risk scores assigned by Qualys. A risk score of 0.0 will be shown as none in the runZero Console, and all other risk scores will match the assigned severity level.

Getting started with Qualys

To set up the Qualys VMDR integration, you’ll need to:

1. Create or obtain user credentials with access to the Qualys API.
2. Configure CVSS scoring in Qualys.
3. Add the Qualys API username, password, and account API URL in runZero.
4. Choose whether to configure the integration as a scan probe or connector task.
5. Activate the Qualys integration to pull your data into runZero.

Requirements

Before you can set up the Qualys VMDR integration:

• Verify that you have runZero Enterprise.
• Make sure you have access to the Qualys Cloud Platform portal.

Step 1: Add the Qualys credentials to runZero

1. Go to the Credentials page in runZero. Provide a name for the credentials, like Qualys.
2. Choose Qualys Username & Password from the list of credential types.
3. Provide the following information:
   • Qualys username - the username you want to use to connect to the Qualys API.
   • Qualys password - the password for your Qualys API username.
   • Qualys account API URL - the URL of the Qualys API for the relevant account. The expected format is https://ip:port or https://domain.tld:port. This URL is unique for each Qualys user.
4. If you want other organizations to be able to use this credential, select the Make this a global credential option. Otherwise, you can configure access on a per-organization basis.
5. Save the credential. You’re now ready to set up and activate the connection to bring in data from Qualys VMDR.

Step 2: Choose how to configure the Qualys integration

The Qualys integration can be configured as either a scan probe or a connector task. Scan probes gather data from integrations during scan tasks. Connector tasks run independently from either the cloud or one of your Explorers, only performing the integration sync.

Step 3: Set up and activate the Qualys integration to sync data

After you add your Qualys credential, you’ll need to sync your data.

Step 3a: Configure the Qualys scan probe

You can run the Qualys VMDR integration as a scan probe so that the runZero Explorer will pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

• Ensure that the QUALYS option is set to Yes in the Probes and SNMP tab and change any of the default options if needed.
• Set the correct Qualys credential to Yes in the Credentials tab.
• Optionally, set the severity and risk levels for ingested vulnerability scan results.

Step 3b: Configure the Qualys connector

A connection requires you to set a schedule and choose a site. The schedule determines when the sync occurs, and the site determines where any new Qualys-only assets are created.

1. Activate a connection to Qualys. You can access all available third-party connections from your inventory or tasks page.
2. Choose the credentials you added earlier. If you don’t see the credentials listed, make sure the credentials have access to the organization you are currently in.
3. Set the severity and risk levels you want to import (optional).
4. Set the Fingerprint only toggle to Yes if you want vulnerability records to be ingested for fingerprint analysis but not stored in your runZero vulnerability inventory (optional).
5. Enter a name for the task, like Qualys sync (optional).
6. Choose the Explorer to perform this connector task from (optional).
7. Choose the site you want to add your assets to. All newly discovered assets will be stored in this site.
8. Enter a description for the task (optional).
9. If you want to exclude assets that have not been scanned by runZero from your integration import, switch the Exclude unknown assets toggle to Yes. By default, the integration will include assets that have not been scanned by runZero.
10. If you want to include assets that have not been assessed for vulnerabilities, switch the Include unscanned assets toggle to Yes.
11. Schedule the sync. A sync can be set to run on a recurring schedule or run once. The schedule will start on the date and time you have set.
12. Activate the connection when you are done. The sync will run on the defined schedule. You can always check the Scheduled tasks to see when the next sync will occur.

Step 4: View Qualys assets and vulnerabilities

After a successful sync, you can go to your inventory to view your Qualys assets. These assets will have a Qualys icon listed in the Source column.

The Qualys integration gathers details about vulnerabilities detected in addition to enriching asset inventory data. Go to Inventory > Vulnerabilities to view the vulnerability data provided by Qualys VMDR.

To filter by Qualys assets, consider running the following query:

• View all Qualys assets:

  source:Qualys
  

Click into each asset to see its individual attributes. runZero will show you the attributes gathered from the Qualys VMDR scan data.