View Remediation Activity
You can view the all the remediation activities that are triggered in your Qualys account for all the 3 cloud providers.
Go to Responses > Remediation Activity. Activities for every cloud are listed under the respective sub tabs.
You could use filters listed in the left pane or form search queries using the search tokens supported by Qualys Query Language (QQL) to filter the activities.
By default, the remediation activity logs are retained for 30 days. The logs older than 30 days are automatically deleted.
Remediation Activity: AWSRemediation Activity: AWS
All the activities that are triggered for AWS resources are listed under Responses > Remediation Activity> AWS sub-tab. The Action column indicated the type of remediation activity initated for a resource.
Actions for AWS resources:
- Stop Instance: indicates stop instance action was initiated for the AWS resource.
- Remove IAM Profile: indicates remove IAM profile action was initiated for the AWS resource.
- Control Remediation: indicates Remediate Now button was used to trigger remediation of the AWS resource for the specified CID.
Remediation Activity: Microsoft AzureRemediation Activity: Microsoft Azure
All the activities that are triggered for Azure resources are listed under Responses > Remediation Activity> Microsoft Azure sub-tab. The Action column indicated the type of remediation activity initated for a resource.
Action for Azure resources:
Control Remediation: indicates Remediate Now button was used to trigger remediation of the Azure resource for the specified CID.
Remediation Activity: GCPRemediation Activity: GCP
All the activities that are triggered for Azure resources are listed under Responses > Remediation Activity> Google Cloud Platform sub-tab. The Action column indicated the type of remediation activity initated for a resource.
Action for GCP resources:
Control Remediation: indicates Remediate Now button was used to trigger remediation of the GCP resource for the specified CID.