Qualys Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

1. Identify your Qualys API Server URL.

2. Create a Qualys user with the Scanner role and API access enabled.

3. Enable CVSS Scoring in your Qualys account.

Create a Qualys User with the Scanner Role and API Access Enabled

1. Log in to the Qualys platform.

2. Click User Role, and assign the Scanner role to the user.

3. Enable access to GUI and API.

   

4. Click Asset Groups and assign the relevant asset groups to the user.

5. Click Save to create the user.

6. In the Qualys navigation bar, click the 9-dot grid icon to open the module picker, then select Administration.

   Note: Administration is the last option in the module picker list. If you do not see it, confirm that your Qualys account has Manager-level permissions.

7. Navigate to Role Management.

8. Locate the Scanner role and select Edit from the Quick Actions menu.

9. Under the Scanner role, ensure that both API access and UI access permissions are selected.

   

10. Select the Permissions tab. From the Modules drop-down, select and enable the following modules:

    • Manage VM Module — grants access to vulnerability management.

    • Manage PA Module — grants access to policy compliance.

    • Asset Management — add the Asset Management role.

    Note: Changes made to a role apply to all users assigned that role. If you do not want to affect other Scanner users, create a dedicated role for the connector user before editing permissions.

11. Click Save to apply the role permissions.

12. Copy the Username and Password to a safe location. You need them to configure the connector.

Enable CVSS Scoring in Your Qualys Account

CVSS scoring is not enabled by default in Qualys. To ensure vulnerability scores are available in Exposure Management, you must enable this feature in your Qualys environment.

1. Log in to Qualys.

2. Navigate to the Reports tab.

3. Select the Setup tab.

4. Click CVSS Scoring.

5. Select the Show CVSS Scoring check box.
   

   

6. Click Save.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library page appears.

   

3. In the search box, type the name of the connector.

4. On the tile for the connector, click Connect.

   The connector configuration options appear.

Configure the Connector

To configure the connector:

1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

2. (Optional) To use a preconfigured on-prem connector to connect to this connector, from the Gateway drop-down, select the on-prem connector you want to use for the connector. Otherwise, select Don't use gateway.

   Note: For information about configuring a gateway, see Tenable On-Prem Connector.

3. In the API Server URL drop-down, select the appropriate server URL to use for API configuration.

4. In the Username and Password text boxes, paste your Qualys client credentials.

5. In the Data Pulling Configuration section, configure the dynamic settings specific to the connector.

   • Use the ark_kernel_filter drop-down to filter vulnerabilities related to the system kernel. This filter helps exclude vulnerabilities that may have already been remediated but are still linked to outdated kernel versions that remain installed.

     Note: Tenable Exposure Management disregards this filter when importing fixed vulnerabilities. This is intentional — Exposure Management continues tracking when a vulnerability was resolved, even if the vulnerable kernel is no longer active.

     Select one of the following options:

     • Vulnerabilities related to the kernel are not filtered based on kernel activity. This matches the default configuration in Qualys, meaning kernel-related vulnerabilities are not filtered based on kernel activity.

     • Exclude kernel-related vulnerabilities that are not exploitable (found on non-running kernels).

     • Include only kernel-related vulnerabilities that are not exploitable (found on non-running kernels).

     • Include only kernel-related vulnerabilities that are exploitable (found on running kernels).

   • From the Subscription Type drop-down, select the subscription type of your Qualys account.

   • (Optional) Enable the Fetch Potential Vulnerabilities option to ingest potential vulnerabilities identified by Qualys. Select this option if your organization wants broader visibility into possibly vulnerable assets, even if the vulnerability has not been confirmed through direct detection.

     Note: Potential vulnerabilities are detections based on indirect evidence (for example, version-based or inferred) rather than confirmed exploit presence. Enabling this setting increases visibility but may introduce additional noise in the findings.
     

   • (Optional) Enable the Fetch Superseded QIDs option to ingest superseded QIDs (Qualys IDs). Enable this option if your organization wants to track historical detection coverage, or if you are working with legacy remediation workflows where superseded QIDs are still relevant.

     Note: Superseded QIDs are older detections that have been replaced by newer signatures in Qualys. Enabling this setting includes them in the findings ingested into Tenable Exposure Management.
     

   • (Optional) In the Tags text box, type a comma-separated list of tags to apply to the ingested Qualys data.

   • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

     Tip: For more information, see Asset Retention.

   • (Optional) From the drop-down, select an asset status — for example, TERMINATED — to automatically remove assets that reach that status.

6. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.
   

   • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.
     

   • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.
     

     

7. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.

8. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.
   

9. To confirm the sync is complete, do the following:

   • Navigate to the Connectors page and monitor the connector's status. Sync is complete once the connector status is Connected.

   • View the sync logs for the connector to monitor the logs for a successful connection.

Qualys in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

1. In Tenable Exposure Management, navigate to the Assets page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

   

   The asset list updates to show only assets from the selected connector.

3. Click on any asset to view Asset Details.

Locate Connector Weaknesses in Tenable Exposure Management

As the connector discovers weaknesses, Tenable Exposure Management ingests those weaknesses for reporting.

To view weaknesses by connector: 

1. In Tenable Exposure Management, navigate to the Weaknesses page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view weaknesses.

   

   The weaknesses list updates to show only weaknesses from the selected connector.

3. Click on any weakness to view Weakness Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

1. In Tenable Exposure Management, navigate to the Findings page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings

   

   The findings list updates to show only assets from the selected connector.

3. Click on any asset to view Finding Details.

Finding Mapping

Tenable Exposure Management Field	Qualys Field
Unique Identifier	Host ID + QID + UNIQUE_VULN_ID
Finding Name	data.TITLE
CVEs	data.CVE_LIST.CVE
Severity Driver	data.CVSS_V3.BASE
Description	data.DIAGNOSIS
Finding Custom Attributes	RESULTS.Package.Installed Version data.openPort.list.HostAssetOpenPort
First Seen	FIRST_FOUND_DATETIME
Last Seen (Observed)	LAST_FOUND_DATETIME

Finding Status Mapping

Note: For Qualys, Tenable Exposure Management uses the report_item_status field to determine finding status.

Finding Severity Mapping

Note: For Qualys, Tenable Exposure Management uses the cvss3/cvss score field to determine severity.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with Qualys to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The following table describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria define how assets and findings are identified and counted from each connector.

Tip:  Read all about Third-Party Data Deduplication in Tenable Exposure Management .

The uniqueness criteria for this connector are as follows:

API Endpoints in Use

List Hosts version: 4.0
				List Agents version: 2.0
				Asset Groups version: 3.0
			Host List Detection version: 3.0

Support Limitations and Expected Behavior

This section outlines any irregularities, expected behaviors, or limitations related to integration of the connector and Exposure Management. It also highlights details about ingested and non-ingested data to clarify data handling and functionality within this integration.

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and Qualys.

Asset Data Validation

Objective: Ensure the number of endpoints (devices) in Qualys matches the number of devices displayed in Tenable Exposure Management.

In Qualys:

The Qualys user interface does not provide a direct filter to view all assets returned by the hosts endpoint. However, you can validate a subset of these assets through the user interface:

1. On the Asset View tab, navigate to Assets, then search using the filter activatedForModules:"VM".

2. In this example, the filtered view in Qualys shows 47 assets.

   

In Tenable Exposure Management:

1. Locate your connector assets.

2. Compare the total number of assets between Qualys and Tenable Exposure Management.

Expected outcome: The total numbers returned in Qualys and Tenable Exposure Management should match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

• The asset was archived based on its last observed date (last_seen field).

• An asset that returns from the Qualys connector with the state "TERMINATED" (configurable) is archived.

• The asset was archived because it did not return in the connector's last sync.

  Tip: To learn more about how assets are archived and findings change status, see Status Update Mechanisms.

Findings Data Validation

Objective: Ensure the number of findings in Qualys matches the number of findings in Tenable Exposure Management.

In Qualys:

1. Navigate to the Assets view.

2. Click the asset you want to validate.

3. Navigate to the Vulnerabilities tab.

4. Ensure all severities are selected in the filter options.

   
   Tip: Only vulnerabilities that are active and not superseded are synced. Apply filters to exclude information, fixed, disabled, and ignored vulnerabilities (if applicable). For accurate comparison, ensure filters in both products align by severity, status, and time of sync.

In Tenable Exposure Management:

1. Locate your connector findings.

2. Compare the total number of findings in Tenable Exposure Management to the number from Qualys.

Expected outcome: The total numbers returned in Qualys and Tenable Exposure Management should match.

If a finding is missing from Tenable Exposure Management or is no longer active, check the following conditions:

• The finding is marked as Fixed and appears under the Fixed state on the Findings screen.

• The finding no longer appears because its related asset was archived.

  Tip: To learn more about how assets are archived and findings change status, see Status Update Mechanisms.