Lookout Mobile Security Connector

Have the following ready before starting the connector configuration:

1. Ensure you have admin-level access to your Lookout Mobile Endpoint Security (MES) console to generate an Application Key.
2. Generate an Application Key from the Lookout MES console. Navigate to Application Keys in the left sidebar under System settings. Click Generate Key, enter a descriptive label, and select the Standard scope (recommended for Mobile Risk API access). Copy and save the Application Key immediately — the key value is not displayed again.
3. Confirm network connectivity: Qualys cloud must be able to reach the Lookout API endpoint (https://api.lookout.com) over HTTPS (port 443).

Generating an Application Key in Lookout

Follow these steps to create the Application Key that the connector uses to authenticate:

1. Log in to the Lookout MES console with Full Access administrator credentials.
2. Navigate to Application Keys in the left sidebar under System settings.
3. Click Generate Key. 
   
   
4. Enter the key information:
   • Label - Enter a descriptive name for the key (for example, Qualys ETM Connector).
   • Scope - Select Standard (recommended for Mobile Risk API access).
     
     
5. Click Next.
6. Copy the Application Key displayed on the screen and store it securely. For security reasons, the key value is not displayed again.
   
   
7. Click OK to complete.

The Application Key is shown only once after creation. If you close the screen without copying it, you must delete the key and create a new one.

Entering Credentials in Qualys ETM

During connector setup in Qualys ETM, enter the URL (https://api.lookout.com) and the Application Key in the authentication fields on the Profile & Connectivity page. The connector uses the Application Key to request a short-lived OAuth 2.0 access token from the Lookout OAuth service (POST https://api.lookout.com/oauth2/token). The returned Bearer token is valid for 1 hour (3600 seconds) and is used for all subsequent Mobile Risk API calls. The connector automatically refreshes the token before each run.

Scope and Data Access

The connector queries the Lookout Mobile Risk API to retrieve device asset records and, when enabled, associated CVE vulnerability data. Optional filter parameters are not supported at this time.

Key Rotation

Application Keys are created with a 2-year validity period. If a key is lost or compromised, delete it in the Lookout MES console under Application Keys (System settings) and generate a new key. Then update the credential in Qualys ETM using the Edit Connector option.

Best practices:

• Store the Application Key in a secure secrets manager.
• Rotate keys periodically.
• Create separate keys for development, staging, and production environments.

Token expiry and rate limits: OAuth 2.0 access tokens expire after 1 hour (3600 seconds) and are automatically refreshed by the connector. The Lookout Mobile Risk API enforces a limit of 100 requests per minute per enterprise. Requests that exceed this limit receive an HTTP 429 response and must be retried using exponential backoff.

This step configures the connector's identity and authenticates it with Lookout.

1. Log in to Qualys ETM and navigate to Connectors > Integration.
2. Locate the Lookout Mobile Security Connector on the Connector Marketplace and click Add. This is a one-time task.

   If the connector is already added, navigate to My Connectors, search for the Lookout Mobile Security Connector, and click Manage Connections.

3. Click Manage Connections from the connector tile.
4. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before proceeding.
5. Click Proceed to Setup.
6. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Type	Description
   Name (required)	String	A unique display name for this connector. Example: Lookout MES Connector
   Description	String	An optional free-text description of this connection (up to 164 characters).
   Preserve Findings Missing in Latest Sync	-	When enabled, findings not returned in the latest sync will remain open and unchanged

   Authentication Details

   Enter the credentials generated from the Lookout MES console.

   Field	Type	Description
   URL (required)	String	The Lookout Mobile Risk API endpoint. Fixed value: https://api.lookout.com
   Application Key (required)	Encrypted String	The Application Key generated in the Lookout MES console under Application Keys (System settings). This value is masked after entry and stored securely by Qualys ETM.

   The Application Key is shown only once in the Lookout MES console. Copy and save it before closing the key creation screen. If the key is lost, delete it, create a new one, and then update this field in Qualys ETM.

   

7. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
   • Authentication Credential Check — Validates the Application Key against the Lookout API authentication endpoint.
   • Authorization Scope Check — Confirms that the provided key has the required permissions to access device and vulnerability data.
   • Data Fetch — Verifies that data can be successfully retrieved from the Lookout Mobile Risk API.
     
     

   All five checks must pass before you can proceed. If any check fails, refer to the Troubleshooting section for resolution steps.

8. Click OK and then click Next.

This step determines what Lookout data is ingested and when the connector runs.

1. Data to Sync - Select one of the following options:
   • Assets & Findings (default) - Syncs both mobile device asset records and vulnerability findings (CVEs) from the Lookout Mobile Risk API.
   • Assets - Syncs mobile device asset records only, without vulnerability findings.
2. Schedule - Under the Schedule section, select an execution frequency from the Occurs dropdown. The default is Daily. The system displays the calculated start date, end date, and timezone for the scheduled run.

   The schedule runs in your configured timezone. The sync remains active for 5 years from the start date and time you confirm in this step.

   
3. Advanced Settings (optional) - Turn on the Advanced Settings toggle to configure Filters, Transform Map, and Risk Severity Mapping. For details, see Advanced Settings.
4. Click Next.

Advanced Settings

Enabling the Advanced Settings toggle on the Scope & Schedule page opens a panel with three tabs: Filters, Transform Map, and Risk Severity Mapping.

Filters

Click Save once the changes are saved in the Advanced Settings panel. 

Transform Map

The Transform Map tab lists the active transformation maps applied to data ingested by this connector.

Transformation maps define how source fields from Lookout are translated into Qualys ETM target fields. For field-level mapping details, see Transformation Maps under Additional Information.

Risk Severity Mapping

The Risk Severity Mapping tab defines how Lookout severity values are translated into Qualys severity levels and QDS scores for findings that are not scored automatically by the Qualys Cloud Threat Database.

Qualys automatically updates scores for CVE-based vulnerabilities available in the Qualys Cloud Threat Database. The severity mapping below applies only to findings that are not CVE-based or are not present in the Qualys Cloud Threat Database.

The default Severity is 2. This value is applied when the severity value from Lookout is unavailable for a given finding.

Review all configured settings before creating the connection and then click Create.

The connection is created and immediately transitions to the Registered state.