Investigate

The Investigation tab offers a centralized interface for analyzing and responding to security threats and network events across your cloud environment. 

It features advanced tools for monitoring and analyzing security incidents through the following components:

Detections

The Detections page provides a comprehensive interface for monitoring and managing security threats identified by Cloud Detection and Response (CDR).

It enables you to:

• View and prioritize active security findings.
• Analyze threat indicators across your infrastructure.
• Take prompt actions to mitigate potential risks.

For more information, see Detections.

Events

The Events page provides detailed visibility into network connection-based events at the AWS appliance level.

CDR imports and analyzes event logs to give you:

• Detailed insights into appliance-level network activity.
• The ability to connect events with larger detection patterns.
• A historical record of activity for analysis.

For more information, see Events.

Cloud Configuration

Cloud Configuration is a metadata-driven query interface that lets you search, filter, and analyze cloud resources across your AWS and Azure environments.

It enables you to:

• Query cloud resource metadata using a no-code, guided query builder or JPQL (JSON Path Query Language).
• Inspect the full metadata of any resource with the built-in JSON Viewer.
• Convert a validated query into a reusable custom security control for continuous monitoring.

Cloud Configuration is currently available in BETA for AWS and Azure environments. To request access, contact your Technical Account Manager (TAM) or Qualys Technical Support.

For more information, see Cloud Configuration.

Sensitive Data

The Sensitive Data tab highlights exposed secrets, such as access keys, credentials, tokens, and certificates, found within your AWS EC2 instances, Azure VMs, and GCP instances. It also detects secrets like embedded keys and credentials during container image scans, all without leaving the Investigate workspace.

It enables you to:

• See cloud resources and container images covered together in one place, so nothing falls between the cracks.
• Triage faster with severity, at-risk accounts and clusters, and a 7-day trend summarized up front.
• Open any finding for full context, down to the raw detection payload, without losing your place in the list.

For more information, see Sensitive Data.