Managing Qualys Scanner Imports

Anomali Security Analytics supports asset report imports from Qualys Cloud.

About Qualys Scanner Imports

When you configure integration with the scanner from Security Analytics, you must specify scanner connection information, including the scanner fully-qualified domain name (FQDN) or IP address and authentication and authorization credentials.

Create a New Scanner Configuration

To import assets from a Qualys scanner:

  1. Click the Settings icon in the left navigation panel and select Security Analytics.

  2. Click Assets.

  3. Click the Scanner tab.

  4. Click Create New Scanner.

  5. Complete the configuration as described in the following table.

    Setting Description
    Scanner Select Qualys.
    Name A meaningful configuration name.
    Host

    Specify the Qualys API server URL, without the protocol (without https://). For example, if the UI platform URL is https://qualysguard.qualys.com, specify the API URL as qualysapi.qualys.com.

    Refer to the following resources from Qualys to look up the API Server URL that applies to your Qualys instance:

    Important: In Security Analytics, specify the variation of the URL that includes api.
    Username User name for connecting to the scanner service.
    Password Password associated with the scanner service.

  6. Click Next.

  7. Specify the schedule and the type of search as described in the following table.

    Setting Description
    Sync Data

    Specify the schedule for the sync job:

    • Interval: Select every 1 day, 2 days, 7 days, 14 days, or 28 days; or select a day of the week to set up weekly scans.

    • Start time: Type the hour (0-23) and minute (0-59).

    Note: The time you specify for asset scanner sync jobs is UTC time with no time zone offset. For example, if you specify the start time for the sync job to be 12:00, it runs at 12:00 UTC, which is 05:00 in Los Angeles and 13:00 in Belfast.
    Scan events for the last

    Specify the time range for returning asset information from the scans in the following format:

    n [Days | Hours | Minutes]
    Search Type

    • IP/IP range: Specify IP addresses and IP ranges (separated by a comma). For example, 192.0.2.5, 192.168.1.1-192.168.1.10, 203.0.113.47

      IP addresses in the range must have the same first octet. For example, 172.x.x.x - 172.x.x.x

      If multiple IP ranges are specified, they should not have overlapping IP addresses.

    • Asset groups: Specify asset groups created on the scanner system. When new groups are created on the scanner service, click to get an updated list of groups, and add them to Security Analytics as needed.
  8. Click Save.
Notes:

  • When the scanner configuration is initially activated, Anomali Security Analytics queries Qualys to scan for the period specified by the Scan events for the last setting. Subsequently, at the time specified by the Each Sync data interval, Security Analytics queries Qualys for the delta (the difference) resulting from changes during the interval period.

  • If you change the Scan events for the last setting, or if you toggle activation off and on again, Security Analytics again queries Qualys for the full period specified by the Scan events for the last setting.

Toggle Activation for a Scanner Configuration

In the Active column, click the checkbox to make the scanner configuration active or inactive.

Modify a Scanner Configuration

In the Actions column, click the Edit icon to modify a scanner configuration.

Clone a Scanner Configuration

In the Actions column, click the Clone icon to create an editable copy of a configuration.

Delete a Scanner Configuration

In the Actions column, click the Delete icon to delete a scanner configuration.

Preview a Scanner Configuration

In the Actions column, click the Preview icon to view the scanner configuration details and to see a detailed history of updates from the scanner. The history is a chronology of successful jobs and jobs that may have terminated due to an error.