Qualys

To see how Cloudaware seamlessly integrates with Qualys in action, request a demo.

Cloudaware CMDB and Breeze agent support Qualys Vulnerability Scanning Service. The integration supports several distinct use cases:

• Qualys as a datasource

• Qualys Breeze plugin

• Qualys as a vulnerability scanning provider

Qualys as a datasource

Cloudaware CMDB supports AWS, Azure, and Google Cloud. Cloudaware enhances CMDB inventory data using Qualys API.

For example, for every EC2, Azure and GCE instance, Cloudaware will use Qualys API to ascertain the Last Scan Date of any instance in question. CMDB users can build a report showing instances that are not getting scanned at all or have not been scanned in a long time.

Here is a complete list of fields that Cloudaware either extracts from Qualys or calculates based on the extracted data:

• Last Scan Date

• Last Scan Result

• Critical Vulnerabilities Count

• High Vulnerabilities Count

• Medium Vulnerabilities Count

• Low Vulnerabilities Count

Cloudaware enhances the following CMDB object types with data from Qualys:

• AWS EC2 Instance

• Azure VM

• Azure Scale Set VM

• GCE Instance

• Physical Server

• VMWare Virtual Machine

In addition, complete vulnerability scan results for every asset are also downloaded into CMDB. Vulnerabilities contain all standard fields from Qualys, such as CVSS Base Score, Risk, Remediation Instructions, Impact, etc.

Key benefits

• Measure Scan Coverage: identify unscanned instances or instances that have not been scanned in a long time.

• Create vulnerability reports that combine data from Qualys, data from cloud providers and other CMDB data, e.g. group critical vulnerabilities by AWS account owner or application, or combine vulnerability data filtered by cloud provider tags.

• Establish other key KPIs, such as MTTR and Scan Frequency.

• Establish a complete risk profile by identifying instances with critical vulnerabilities that are also in permissive/public security groups, subnets, VPCs.

Qualys Breeze plugin

Cloudaware Breeze is an agent that customers can optionally deploy to cloud compute, virtual, and on-prem instances. Cloudaware uses Breeze agent data to enhance CMDB with OS-level information and data about installed packages, patches, services, users, and performance metrics.

The Breeze agent has several capabilities in regards to Qualys:

1. Discover and interrogate the Qualys Agent state and version.
Qualys is a supported software in Breeze’s software asset management capability. CMDB users can use Breeze agent data to create software asset inventory reports showing which versions of Qualys are installed. In addition, Breeze catalogs the state of the Qualys Agent - whether it is running or not.

2. Install/uninstall or configure the Qualys Agent.
When deployed in DevOps mode, the Breeze agent can not only interrogate the state of the pre-existing Qualys Agent but install and configure it as well. If Breeze detects that the agent is corrupt or missing, not starting or otherwise malfunctioning, it will perform clean reinstall of the Qualys Agent to enforce the desired state. Breeze supports deployment of Qualys agents on all Breeze-supported operating systems.

License management

The Breeze agent will coordinate with CMDB to manage the Qualys Agent registration and de-registration processes. During the registration process, CMDB will furnish Breeze Agent with Qualys registration keys based on the attributes of the instance where Breeze is running, such as cloud provider account ID, VPC, or application name.

When CMDB notices instances that have been terminated or stopped for over 24 hours, it will issue an asset de-registration request directly to Qualys API endpoint. Once the server is restarted, Breeze will re-register the Qualys Agent upon boot.

Vulnerability scanning provider

Cloudaware offers vulnerability scanning as a service (VSaaS). When subscribing for VSaaS, Cloudaware will ensure that all infrastructure gets scanned at least once a week. Cloudaware VSaaS supports Qualys as a vulnerability scanning provider. Breeze agent will automatically deploy and perform at least one scan every 7 days.

When subscribing to VSaaS, customers can bring their own licenses or leverage licenses provided by Cloudaware.

Permissions and settings

If Qualys is acting as datasource only, Reader role is sufficient. However, if Cloudaware/Breeze is managing the agent deployment along with activation and de-activation, Cloudaware user needs to be given permissions to Install/Uninstall and Activate/Deactivate agents as shown here.

Setup in Cloudaware

1. Log in to Cloudaware account → Admin.

2. Find Qualys in the list of Security integrations. Click +Add.

3. Fill out the form:

4. The green light in 'Status' means that Qualys integration has been successfully added. If there is a red light, please contact support@cloudaware.com.