Configure Zero-Touch Snapshot-based Scan

Follow the steps below to generate Subscription Token

1. Generate AuthToken by running the below command

   curl --location --request POST 'https://< API Gateway URL >/auth' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'username=<QualysUsername>' --data-urlencode 'password=<QualysPassword>' --data-urlencode 'token=true'
2. Generate SubscriptionToken by running the below command

   curl --location --request POST 'https://< API Gateway URL>/qas/subscription-token' --header 'Content-Type: application/json' --header 'Authorization: Bearer <Auth Token>' --data-raw '{ "expiry": 500000}' 

3. Store the generated SubscriptionToken for later.

 

 The 'Enable Snapshot Based Scan' option is not visible to you yet. This is because the AWS account is yet to be registered as a service account.

Register your AWS account as a service account to scan the assets of your target accounts. A service account is necessary to run snapshot scans.

1. Login to AWS > CloudFormation
2. Stacks > Create Stack > With new resources (standard)
3.  Under Prerequisite - Select Template is ready.
4.  Upload the CloudFormation Template under 'Specify Template' and click Next.
   
5. Next, provide the stack parameters.
   • AdditionalTagKey: Optional field to add another tag key besides the mandatory key field listed below.
   • AdditionalTagValue: Optional field to add another tag value besides the mandatory field listed below.
   • Concurrency:  Provide the number of regions to be concurrently scanned. The value must be between 1 and 4 (where 1 is 10 and 4 is 40). Eg: If the value provided is 2 for an account with 20 regions, the scanner scans instances of 10 regions 2 times.
   • IntervalHours: Set the interval to launch then next scan. Provide the value in hours. The minimum value is 24 hours.
   • QEndPoint: Provide the gateway url of your QualysGuard account. Find the Gateway URL at https://www.qualys.com/platform-identification/
     
   • QToken: Provide the Qualys Subscription token as mentioned in Generate a Subscription Token
   • Regions: Specify the AWS regions that should come under snapshot scan. Eg, ap-south-1, us-east-1.
   • Single Region Concurrency: Provide the number of scanner instances to execute scans on a single region. The value must be between 1 and 7 (where 1 is 10 and 7 is 70). 
   • TagKey and TagValue: Filter instances to scan by the key-value pair for a tag. This is a mandatory field.
   • SubnetCIDR: Provide the Subnet Cidr. Eg, 10.82.64.0/22.
   • VpcCidr: Provide the Vpc Cidr. Eg, 10.82.64.0/22.
     
6. Click Next.
7. Keep the default setting > Next.
8. Review your configurations.
9. Check the acknowledgments. 
   • I acknowledge that AWS CloudFormation might create IAM resources. 
   • I acknowledge that AWS CloudFormation might create IAM resources with custom names.
   • I acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND

10. Click Submit.

Once the Service Account Template configuration is completed, proceed to the next step.

Only a single AWS Account connector with CSPM capability can be registered as a service account.

A target account is where the snapshot scans run on. You can configure multiple target accounts to run scans on different accounts.

1. Login to AWS > CloudFormation.
2. Stacks > Create Stack >With new resources (standard).
3. Under Prerequisite - Select Template is ready.
4. Upload the CloudFormation Template under 'Specify Template' and click Next.
   
5. Next, give a name for the stack and provide the parameter.
6. AWSSourceAccount: Enter the AWS Service account number
   

The remaining configurations are the same as Generate a Subscription Token .

Check the acknowledgments before submitting.

1. I acknowledge that AWS CloudFormation might create IAM resources. 
2. I acknowledge that AWS CloudFormation might create IAM resources with custom name.
3. I acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND

Note: A QualysTargetAccount CF template must be deployed for every account on which Snapshot-Based Assessment needs to be carried out.

1. Login to Qualys Console > Navigate to TotalCloud.
   
2. Click Configure Connector.
3. Click Manage Connector.
   1. Select the Connector type.
   2. Enter the Connector name.
   3. Add Role ARN.
4. Under FlexScan, select Snapshot-based Scan.

5. Enable Cloud Security Posture Management, if necessary.

6. Add tags, if necessary.

7. Validate and Save.

1. Login to Qualys Console > Navigate to Connectors Application.

2. Click Amazon Web Service > Create Connector.

3. Configure Basic Details: Name, Description, Application > Next

4. Configure Authentication Details: Account Type, Polling Frequency, Role ARN > Next.

5. Configure Region Selection: Select regions for the AV inventory.

6. Configure Tags and Activation: - Select “Enable Zero-Touch API Snapshot Based Scan” and tags for the discovered assets as per requirement. Download the CFT templates as specified on the right.

7. Review and Confirm.

1. Login to Qualys Console > Navigate to Connectors Application.

2. Click Amazon Web Services > Select the Connector where the  Service account CFT was deployed > Click Edit > Navigate to Tags and Activation.

3. Select Automatically activate all assets for the VM Scanning application > Check the Enable Zero- touch Snapshot Based Scan box.

4. Click Save.

1. How to register a service account?

A: Deploy the CFT-S on an AWS account which customer wishes to register as a service account.

Or, customer can also use the newly introduced API to register a service account. Learn more.

2. How to deregister a service account

A: We have introduced new API to deregister service account. Learn more.

Or, the customer can delete the connector which was registered as a service account.

3. Why is the 'Enable Snapshot Based Assessment' checkbox greyed-out when creating a connector?

A: The checkbox remains greyed-out when your snapshot scan is enabled from the portal back office but you have not registered a service account. 

4. Why does the 'register service account' step function fail a fter running CFT-S?

A: The 'register-service-account' step function fails in below scenarios:

• If the connector which is registered as the service account is deleted/disabled.
• If the CloudView subscription is expired.

5. Why does Asset activation fail showing  'ip-limit-exceeded'?

A: The error shows up when you have exhuasted your IP limit. Contact support to get your licence extended.

6. How to delete a CFT-S?

A: Follow the steps below to delete a service account CloudFormation Template.

1. Delete the cross-region-stack - select the checkbox to retain the resources
2. Go to StackSets > StackInstances > check if there are any running stack sets on other regions and delete them, if present
3. Navigate back to the service account and try deleting the CFT-S again - do not check the checkbox for retaining the resources
4. At this stage, cross-region-vpc stack is deleted from your service account
5. Run this command on CLI - aws cloudformation delete-stack-instances --stack-set-name snapshot-scanner-2-cross-region-vpc --accounts 99*******98 --regions us-east-1 us-west-2 --retain-stacks
6. At this stage, StackInstances on the StackSet are deleted
7. Now, Delete the StackSet as it is empty (does not contain any StackInstances)

8. How to update Region/Tags/QToken

   1. Replace the current template

   2. Upload the cft-s that you used before

   3. Edit Region/Tags/QToken

7. Can a customer subscribe to have API Based Assessment and Snapshot Based Assessment at once?

A: Yes, a customer can subscribe to both scans at once.

8. Can there be spaces or tabs in the tags given in CFT-S?

A: No, tags do not suppot prefixes, suffixes, spaces or tabs in the CFT-S.

9. Can there be multiple service accounts?

A: No, there can only be one service account for a subscription.

Note: Customer can configure multiple target accounts

10. Can the service account also be the target account?

A: Yes, the service account can be a target account as well.

11. Can the scan interval be set to 1 hour?

A: No. The minimum scan interval is 24 hours.