Cloud Agent for WSL Detection
Cloud Agent supports scanning Windows Subsystem for Linux (WSL) instances installed on Windows assets. This enables Cloud Agent to collect inventory and monitor WSL instances, and provides visibility into installed packages, WSL status, user information, Cloud Agent status, and authorized and unauthorized WSL instances.
This feature has limited availability. Contact your Technical Account Manager or Qualys Support to it. This feature is available with Cloud Agent for Windows 6.6 release.
This feature facilitates determining:
- WSL Status (Running or Stopped).
- Collects inventory of WSL instances.
- Availability of Cloud Agent in a WSL instance.
How to Enable Cloud Agent for WSL Detection
The following are the steps to enable WSL detection on Windows assets:
- To enable Cloud Agent for WSL, navigate to Configuration > Configuration Profiles window in Cloud Agent user interface.
- Create a new configuration profile or edit an existing profile.
- In the Basic Details windows locate the Additional Settings section.
- Select the Enable Windows Subsystem Linux (WSL) Detections checkbox. You can assign this configuration profile to the required Cloud Agents for monitoring WSL on their hosts.
WSL service restart or system reboot is required for WSL detection changes to take effect.
Where to Find WSL Logs
The WSL2 detection logs are available at:
C:\ProgramData\Qualys\QualysAgent\WSL\Bin\wsl_plugin_log.txt
QIDs for WSL Detection
We have released the following QIDs to collect the WSL information.
- QID 45764: Installed Packages on Windows Subsystem for Linux (WSL) Detected
- QID 45763: Windows Subsystem for Linux (WSL) Metadata Detected
- QID 45736: Windows Subsystem For Linux (WSL) Instances Detected
- QID 45519: Windows Subsystem for Linux (WSL) Installation Detected