Qualys Dataflow for Container Security Connector
The Qualys Dataflow for Container Security Connector automates the ingestion of container image and instance data from Qualys Container Security into Qualys Enterprise TruRisk Management for centralized risk analysis. By consolidating container asset information with vulnerability findings in a unified platform, security teams can prioritize remediation efforts more effectively and gain comprehensive visibility into container-based infrastructure risks.
The connector supports delta synchronization between Container Security data models and the ETM risk management system. This integration enables teams to correlate container vulnerabilities with business context and organizational risk posture. By eliminating manual data silos between container security tools and enterprise risk management, the integration helps teams make faster, more informed decisions about container security investments and remediation strategies.
Connector Details
| Vendor | Qualys |
|---|---|
| Product Name | Qualys Dataflow for Container Security |
| Category | Container Security |
| Works With | Qualys Enterprise TruRisk™ Platform (ETM) |
| Connector Type | ROC Connector |
| Supported Assets | Container Images, Container Instances |
| Findings Support | Yes |
| Version | 1.0 |
| Supported Version & Type | SaaS (Latest) |
| Integration Type | API Integration |
| Authentication Type | Basic Authentication, OAuth |
| Direction | Unidirectional (Qualys > Qualys) |
| Incremental Sync (Delta) | Supported |
| Import of Installed Software | Supported |
| Import of Source Tags | Supported |
| Filters / Filter Query | Supported |
Supportability MatrixSupportability Matrix
The table shows supported (✓), unsupported (—), and vendor-not-supported (NA) asset classes and finding types across AWS, Azure, GCP, and OCI.
✓ = Supported.
— = Not Supported.
NA = Vendor does not support this.
The Resource Type row shows the specific cloud service targeted for each asset class.
In the table below, "—" entries indicate the asset class/finding type combination is not yet available for that cloud provider. NA indicates that the CNAPP vendor is currently not supporting this asset class/finding type combination.
| Asset Class | Finding Type | AWS | Azure | GCP | OCI | Generic |
| Container Image | Resource Type | Amazon ECR (Container Image) |
Azure Container Registry (ACR Image) |
Google Artifact Registry (Container Image) |
OCI Container Registry (OCIR Image) |
Generic (Host Based and all other registries) |
| Inventory | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Vulnerabilities | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Misconfigurations | — | — | — | — | — | |
| Container Instance | Resource Type | Amazon ECS Task/ AWS Fargate Container |
Azure Container Instance (ACI) |
GKE Pod / Cloud Run Container |
OCI Container Instances | Generic (Host /Cluster Based) |
| Inventory | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Vulnerabilities | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Misconfigurations | — | — | — | — | — |
Configure the Connector
Before You Begin - AuthenticationBefore You Begin - Authentication
Before configuring the connector, ensure the following prerequisites are completed:
- Ensure you have Qualys Container Security credentials:
- Username and password for Basic Authentication
- Client ID and Client Secret for OAuth
- Note the Qualys Gateway URL, for example:
https://gateway.qg1.apps.qualys.com
Generate Authentication Credentials
Using Basic Authentication
- Open Qualys Container Security.
- Identify the appropriate Gateway URL for your subscription.
- Create or use an existing service account with access to Container Security APIs.
- Copy the username and password.
- Enter the values during connector configuration in ETM.
Using OAuth
- Create or identify an OAuth application in Qualys.
- Copy the Client ID and Client Secret.
- Enter the OAuth credentials during connector configuration.
Store OAuth Client Secrets securely. Access to secrets may be restricted after creation, depending on your Qualys configuration.
Permissions Required
Scope and Data Access
The connector credentials must have access to the following Container Security API endpoints:
| Purpose | Endpoint |
|---|---|
| List Container Images | /csapi/v1.3/images/list |
| List Containers | /csapi/v1.3/containers/list |
Key Rotation
When rotating credentials, update the connector configuration in ETM using the Edit Connector option.
Create a Profile & ConnectionCreate a Profile & Connection
- Navigate to Connectors in ETM.
- Select Qualys Dataflow for Container Security.
- Click Create Connection.
- Provide the connection profile information.
- Configure authentication details.
- Run Test Connection.
- Click Next.
Connector Details
| Field | Type | Description |
|---|---|---|
| Name | String | Name of the connector profile. |
| Description | String | Description of the connector configuration. |
Authentication Details
| Field | Type | Description |
|---|---|---|
| Is IP Restricted | Boolean | Enable if API access is restricted to approved IP addresses. |
| Base URL | String | Qualys Gateway URL.
Example: https://gateway.qg1.apps.qualys.com
|
| Authentication Mechanism | String | Select the authentication type such as BASIC. |
| Username | String | Container Security username. |
| Password | Encrypted String | Password for the Container Security account. |
The Test Connection workflow validates the following checks:
- Network Reachability
- TLS Handshake
- Authentication Credential Check
- Authorization Scope Check
- Data Fetch
Click Next once the Test Connection is successful.
Set the Scope & ScheduleSet the Scope & Schedule
Follow the steps below to set up the scope and schedule.
- Select the data types to synchronize and configure the execution schedule.
- Select the supported sync option as:
- Assets & Findings
- Assets
- Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest into ETM.
If you do not turn on Advanced Settings, the connector uses the default settings and ingests all asset classes and vulnerability findings.
- Select a schedule from the Schedule list. To add a custom schedule, turn on Advanced Settings, select Custom from the Schedule list, and enter the schedule.
-
The schedule configuration supports recurring synchronization, such as
Daily.Schedules are configured using the selected ETM timezone and can run for up to 5 years.
Advanced Settings
Use the Advanced Settings to configure filtering and transformation options, set the data ingestion starting point, and control the data to ingest.
Filters
Add Tag in Container Security
1. Add the tags from Container Security > Assets > Images.
2. Select the image and then select Add Tags from the Quick Actions menu.
The Tag field displays a list of tags only if the tag is added to the asset. For more information about configuring the Tag, refer to Create and Assign Tags to Assets. Once the tag is available, you can use it in the Tag Filter field while configuring the connection.
Add Filters in Advanced Settings
1. Tag Filter: Enter comma-separated tag values to limit data ingestion to assets that match the specified tags.
2. Last VM Scanned: Select a date from the date picker to limit data ingestion to assets that were last scanned on or after the selected date.
The Last VM Scanned date is available in the source Container Security module. It indicates when an asset was last assessed. If an asset was discovered only by a host sensor and does not have an active container sensor, the value is Null. This filter applies only to assets that have a Last VM Scanned value in the source account.
3. Asset Types: Select the asset types to ingest - Assets or Assets and Finding from the multiselect list available for each connector's supported asset class and finding type.
The connector supports chip-based asset type filtering. The Available asset type chips:
- Container Image
- Container Instance
4. Retain Previously Ingested Delta: If enabled, the connector supports delta synchronization for incremental data retrieval.
5. Findings: The Findings dropdown helps you select supported findings categories.
Save the changes after modifying filter selections in Advanced Settings.
Review and ConfirmReview and Confirm
Review the connection, then click the Create button.
Transform Map
The connector includes default transformation maps for Container Security Image and Container Security Instance assets and findings.
The connector retrieves the default transformation map configured for the Container Security Image and Container Security Instance connector and uses it to transform data when the connector profile runs.
Container Security Image Container Security Image
| Source Field | Target Field |
repo.0.registry |
asset.assetDetail.containerImageAssetClass.registry |
repo.0.tag |
asset.assetDetail.containerImageAssetClass.tag |
repo.0.repository |
asset.assetDetail.containerImageAssetClass.name |
repo.0.repository |
asasset.assetDetail.name |
repo.0.repository |
asset.assetDetail.containerImageAssetClass.repository |
sha |
asset.assetHeader.externalAssetId |
sha |
asset.assetDetail.containerImageAssetClass.digest |
architecture |
asset.assetDetail.containerImageAssetClass.architecture |
uuid |
asset.assetHeader.vendorAssetId |
size |
asset.assetDetail.containerImageAssetClass.sizeInBytes |
layers[].size |
asset.assetDetail.containerImageAssetClass.layers[].sizeInBytes |
layers[].sha |
asset.assetDetail.containerImageAssetClass.layers[].digest |
layers[].createdBy |
asset.assetDetail.containerImageAssetClass.layers[].command |
created |
asset.assetDetail.containerImageAssetClass.creationDate |
qid |
findingGroup.findings[].externalFindingId |
qid |
findingGroup.findings[].findingType.vulnerability.vendorId |
cveids.0 |
findingGroup.findings[].findingType.vulnerability.cveId |
severity |
findingGroup.findings[].severity |
status |
findingGroup.findings[].findingStatus |
firstFound |
findingGroup.findings[].firstFoundOn |
lastFound |
findingGroup.findings[].lastFoundOn |
Version |
findingGroup.findings[].product.version |
Software Name |
findingGroup.findings[].product.name |
Fix Version |
findingGroup.findings[].solutionRecommendation |
Type Detected |
findingGroup.findings[].typeDetected |
Affected Layer |
findingGroup.findings[].attributes.affected_layer_sha |
attackVector |
findingGroup.findings[].findingType.vulnerability.cvss.vector |
title |
findingGroup.findings[].name |
title |
findingGroup.findings[].description |
baseScore |
findingGroup.findings[].findingType.vulnerability.cvss.baseScore |
operatingSystem |
asset.assetDetail.containerImageAssetClass.os |
Category (SCA/STATIC) |
findingGroup.findings[].findingType.vulnerability.category |
Scan Type |
findingGroup.findings[].detectionMethod |
assetTypeName |
asset.assetHeader.assetTypeName
|
accountId
|
asset.assetDetail.typedAttributes.cloudAccountId
|
cloudRegion
|
asset.assetDetail.typedAttributes.cloudRegion
|
cloudVendor
|
asset.assetDetail.typedAttributes.cloudVendor
|
accountId
|
asset.assetDetail.cloudInfo.accountId
|
cloudRegion
|
asset.assetDetail.cloudInfo.region
|
cloudVendor
|
asset.assetDetail.cloudInfo.provider
|
created
|
asset.assetDetail.sourceCreatedAt
|
updated
|
asset.assetDetail.sourceUpdatedAt
|
Container Security InstanceContainer Security Instance
| Source Field | Target Field |
portMapping.port |
asset.assetDetail.containerInstanceAssetClass.ports[].containerPort |
portMapping.protocol |
asset.assetDetail.containerInstanceAssetClass.ports[].protocol |
portMapping.hostport |
asset.assetDetail.containerInstanceAssetClass.ports[].hostPort |
created |
asset.assetDetail.firstSeen |
updated |
asset.assetDetail.lastSeen |
uuid |
asset.assetHeader.vendorAssetId |
sha |
asset.assetHeader.externalAssetId |
imageDetails[0].repo.0.repository |
asset.assetDetail.containerInstanceAssetClass.image.name |
imageDetails[0].repo.0.repository |
asset.assetDetail.containerInstanceAssetClass.image.registry |
imageSha |
asset.assetDetail.containerInstanceAssetClass.image.digest |
imageDetails[0].repo.0.tag |
asset.assetDetail.containerInstanceAssetClass.image.tag |
name |
asset.assetDetail.name |
host.hostname |
asset.assetDetail.containerInstanceAssetClass.host.name |
host.ipAddress |
asset.assetDetail.containerInstanceAssetClass.host.ipAddress |
state |
asset.assetDetail.containerInstanceAssetClass.status |
state |
asset.assetHeader.status |
customerUuid |
asset.assetHeader.customerId |
containerId |
asset.assetDetail.containerInstanceAssetClass.id |
stateChanged |
asset.assetDetail.containerInstanceAssetClass.startTime |
ipv4 |
asset.assetDetail.containerInstanceAssetClass.privateIpv4Addresses[0] |
ipv6 |
asset.assetDetail.containerInstanceAssetClass.privateIpv6Addresses[0] |
QID |
findingGroup.findings[].externalFindingId |
QID |
findingGroup.findings[].findingType.vulnerability.vendorId |
vulnDetails.details[].cveids.0 |
findingGroup.findings[].findingType.vulnerability.cveId |
Severity |
findingGroup.findings[].severity |
status |
findingGroup.findings[].findingStatus |
First Found (ms) |
findingGroup.findings[].firstFoundOn |
Last Found (ms) |
findingGroup.findings[].lastFoundOn |
Version |
findingGroup.findings[].product.version |
Software Name |
findingGroup.findings[].product.name |
Fix Version |
findingGroup.findings[].solutionRecommendation |
Type Detected |
findingGroup.findings[].typeDetected |
Affected Layer |
findingGroup.findings[].attributes.affected_layer_sha |
attackVector |
findingGroup.findings[].findingType.vulnerability.cvss.vector |
Title |
findingGroup.findings[].name |
Title |
findingGroup.findings[].description |
CVSS v3 Base Score |
findingGroup.findings[].findingType.vulnerability.cvss.baseScore |
Operating System |
asset.assetDetail.containerInstanceAssetClass.os |
Category (SCA/STATIC) |
findingGroup.findings[].findingType.vulnerability.category |
Scan Type |
findingGroup.findings[].detectionMethod |
assetTypeName |
asset.assetHeader.assetTypeName
|
cloudProviderInfo.accountId
|
asset.assetDetail.typedAttributes.cloudAccountId
|
cloudProviderInfo.region
|
asset.assetDetail.typedAttributes.cloudRegion
|
cloudProviderInfo.type
|
asset.assetDetail.typedAttributes.cloudVendor
|
cloudProviderInfo.accountId
|
asset.assetDetail.cloudInfo.accountId
|
cloudProviderInfo.region
|
asset.assetDetail.cloudInfo.region
|
cloudProviderInfo.type
|
asset.assetDetail.cloudInfo.provider
|
containerQlp
|
asset.assetDetail.typedAttributes.containerInstanceQLP
|
How the Connection Works
The Qualys Dataflow for Container Security Connector automates the ingestion of container image and container instance asset data from Qualys Container Security into Qualys ETM for unified risk analysis and prioritization.
The connector supports delta (incremental) synchronization and retrieves container metadata through the Container Security API.
Each run retrieves container image assets and findings including registry, tag, repository, SHA digest, architecture, UUID, size, layers, and creation date. Container instance assets and findings include port mappings, creation and update timestamps, vendor ID, image name, hostname, IP addresses, state, container ID, and start time.
Connector States
After the connector is created, it transitions through the following states:
| Registered | The connector is successfully registered and ready for synchronization. |
|---|---|
| Scheduled | The connector is queued for the next scheduled execution. |
| Processing | The connector is actively retrieving asset and findings data. |
| Processed | The connector completed asset synchronization successfully. |
Initial synchronization and findings processing can take up to 2 hours after the connector reaches the Processed state.
Viewing Assets and Findings in ETM
Follow the steps below to view the assets in ETM.
1. Navigate to Enterprise TruRisk Management > Inventory > Assets.
2. Select the asset type. Example: Container
Use the QQL filter: asset.inventory:(source: `Qualys CS`)
Follow the steps below to view the findings in ETM.
1. Navigate to ETM > Risk Management > Findings.
2. Select Finding.
Use the QQL filter: finding.vendorProductName:`Qualys CS`
Troubleshooting
| Issue | Resolution |
|---|---|
| Authentication failure on connector run | Verify the Gateway URL, username/password, or Client ID/Client Secret entered in ETM. Confirm the credentials have Container Security API access. |
| No assets imported after first run | The connector may take up to 2 hours for completion. Verify Container Security has active container images and instances. Check the connector state in ETM. |
| Connector not available in the integrations list | The connector requires activation. Contact your TAM or Qualys Support to activate it. |
Additional Information
API Reference
| API | Endpoint |
|---|---|
| Container Images API | /csapi/v1.3/images/list |
| Containers API | /csapi/v1.3/containers/list |