HCL AppScan (DAST) Connector

Ensure the following prerequisites are in place before configuring the connector in Qualys ETM.

1. Ensure you have access to your HCL AppScan account at https://cloud.appscan.com/ with permissions to generate API credentials.
2. Generate API credentials in HCL AppScan. Navigate to Tools > API and click Generate to obtain a Key ID and Key Secret. Store them securely.
3. Note your HCL AppScan Domain URL (for example, https://cloud.appscan.com).
4. Confirm network connectivity: Qualys cloud must be able to reach your HCL AppScan instance over HTTPS (port 443).

Generating API Credentials in HCL AppScan

The following steps describe how to generate the Key ID and Key Secret required to authenticate the connector.

1. Log in to HCL AppScan at https://cloud.appscan.com/.
2. From the navigation menu, go to Tools > API and click Generate to create new API credentials.
3. Copy and securely store the Key ID and Key Secret that are displayed. You will need both values during connector setup in Qualys ETM.

The Key Secret may only be visible at the time of generation. If you navigate away without saving it, you may need to generate a new key pair. Store the Key Secret in a secure credential vault immediately.

During connector setup in Qualys ETM, enter the Domain URL, Key ID, and Key Secret in the authentication fields on the Profile & Connectivity screen. Select the appropriate finding type and asset type for web applications.

Permissions Required

The HCL AppScan account used to generate API credentials must have authorization to access the API Key page and generate credentials. The account must have read access to applications and issues data.

Scope and Data Access

The connector queries the following HCL AppScan endpoints:

• /api/v4/Apps – retrieves web application asset records with a default batch size of 50 records per request.
• /api/v4/Issues/Application/{ApplicationId} – retrieves DAST vulnerability findings per application with a default batch size of 50 records per request.

Filters are supported using OData-style syntax and can be configured in the connector profile. Example expressions include Name eq 'www.test.com' to filter by application name, or LastUpdated ge 2024-11-18T18:09:14Z for timestamp-based filtering.

Key Rotation

When rotating API credentials, generate new credentials in HCL AppScan under Tools > API. Update the Key ID and Key Secret in Qualys ETM using the Edit Connector option. The connector will use the new credentials on its next scheduled run.

Configure the connector's identity and authenticate with the HCL AppScan source system.

Connector Details

Authentication Details

API tokens generated in HCL AppScan expire or may be revoked. If the connector begins reporting authentication failures, regenerate the Key ID and Key Secret in HCL AppScan and update the connector using Edit Connector.

After entering all authentication fields, click Test Connection to validate connectivity before proceeding. The following checks are performed:

• Network Reachability
• TLS Handshake
• Authentication Credential Check
• Authorization Scope Check
• Data Fetch

If Network Reachability fails with error code Unknown Host, verify that the Domain URL is correct and that Qualys cloud can reach the HCL AppScan API over HTTPS (port 443). Check that the API credentials have not been revoked. All subsequent checks (TLS Handshake, Authentication Credential Check, Authorization Scope Check, and Data Fetch) will also fail if network reachability cannot be established.

This step defines what data to synchronize and how frequently the connector should run.

This connector pulls the following data types on each run:

• Assets (Host Asset Records) – web application records from HCL AppScan.
• Vulnerability Findings (CVEs) – DAST issue records associated with each application.

Configure the sync schedule to set the frequency at which Qualys ETM polls HCL AppScan for new or updated data.

Advanced Settings (optional) — Click Advanced Settings to configure filters, review the active transform map, and customize risk severity mappings. See Advanced Settings below.

Schedule - Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

Delta (incremental) synchronization is supported. After the initial full sync, subsequent runs retrieve only records that have been added or modified since the last successful run, reducing API load and sync duration.

Review all connector settings before saving.

Advanced Settings

Enabling the Advanced toggle on the Scope & Schedule page or clicking the Advanced Settings link opens a panel with three tabs: Filters, Transform Map, and Risk Severity Mapping.

Filters  

Transform Map

The HCL AppScan (DAST) Connector includes an out-of-box transform map that handles field-level mapping from HCL AppScan source attributes to the Qualys ETM target schema. No additional configuration is required to use the default map.

To view the active mapping or clone the map to create a customized version, open the Transform Map tab in Advanced Settings. Click Create New to define a custom transform map that specifies a Source Data Model and a Target Data Model.

Risk Severity Mapping

The Risk Severity Mapping tab controls how MDE severity values translate into Qualys Detection Score (QDS) values for non-CVE findings. For CVE-based vulnerabilities in the Qualys Cloud Threat Database, QDS scores are automatically updated by Qualys and are not affected by this mapping.

Configure five rows mapping the vendor's expected source values to Qualys severity levels (1–5) and corresponding QDS scores (0–100). A Default Severity dropdown is also available - this value is applied when the severity field is unavailable in the source data.

Qualys automatically updates scores for CVE-based vulnerabilities available in the Qualys Cloud Threat Database. The severity mapping below applies only to findings that are not CVE-based or are not present in the Qualys Cloud Threat Database.

The default Severity is 2. 

Click Save to create the connector. The connector is registered in Qualys ETM and will run according to the configured schedule.fter savng, navigate to Advanced Settings to configure optional filters or review the transform map. Changes to Advanced Settings require clicking Save again within that panel.

Review the connection, then click the Create button. 

The connector connection is created and immediately transitions to the Registered state.