Connector Release 2.22

Applicable for:

With this release, we are adding FlexScan support for Oracle Cloud Infrastructure (OCI) to enable agentless, automated security scanning of your OCI Compute instances. You can now achieve consistent, snapshot-based scanning across multi-cloud environments, including AWS, Azure, GCP, and OCI, enabling unified visibility and risk management through Qualys TotalCloud.

Key Capabilities

• Agentless Snapshot-Based Scanning: Discovers OCI Compute instances and performs OS vulnerability scans on Linux-based instances using volume backups, without deploying agents.
• Automated Deployment & Lifecycle Management: Terraform-based setup provisions the IAM users, groups, policies, and dynamic group required for scanning, and optionally creates the scanner compartment. FlexScan creates the scanning infrastructure at runtime and cleans up temporary backups, volumes, and scanner instances automatically.
• Flexible Coverage: Supports multi-compartment and multi-region scanning with tag-based targeting.
• Integrated Visibility: Vulnerability findings are automatically available in TotalCloud.

Benefits

• No Impact on Workloads: Snapshot-based scans ensure zero disruption to running instances.
• Reduced Operational Overhead: No agent deployment; automated provisioning and cleanup simplify operations.
• Consistent Multi-Cloud Coverage: Identify OS vulnerabilities in OCI with the same snapshot-based workflow used across your other cloud environments.

Prerequisites: An active Qualys TotalCloud subscription and a tenancy-level OCI connector.

How to Enable FlexScan for OCI

• Deploy the provided Terraform configuration to provision the required permissions and the Service Account compartment.
• Register the Service Account with the "Register Service Account" API using cloudType OCI, then configure the required scan-related settings with the "Setup Service Account" API. All scans run under the configured Service Account.
• After the Service Account is registered, enable the "Zero-Touch Snapshot-based Scan" option in the OCI connector configuration.
  Optionally, use the "Setup Target Account" API to override scan settings for specific target compartments.

In this release, snapshot-based scan for OCI supports only OS scans for Linux-based instances. Software Composition Analysis (SCA), Secrets scans, Windows-based instances, and on-demand scans are not supported.
Contact your Technical Account Manager (TAM) or Qualys Support to activate this feature.

For more information, refer to Configure Zero-Touch Snapshot-based Scan for OCI.

Applicable for:

With this release, Zero-touch Snapshot-based Scan for Microsoft Azure supports the new Qualys Native deployment architecture, the same deployment model that is available for Google Cloud Platform (GCP). You provision the Service Account subscription using the Qualys-provided Terraform configuration, and then register and configure the Service and Target Accounts using the FlexScan APIs. This enables agentless, automated security scanning of your Azure virtual machines with a consistent snapshot-based workflow across clouds.

Key Capabilities

• Agentless Snapshot-Based Scanning: Discovers Azure VMs and performs OS vulnerability, Software Composition Analysis (SCA), and Secrets scans on Linux-based instances, and OS scans on Windows-based instances, without deploying agents.
• Terraform-Based Deployment: Provisions the Qualys service principal, custom roles, managed identity, and required resource providers in the Service Account subscription. You can scope the scanning permissions to the tenant root management group, specific management groups, or specific subscriptions.
• API-Driven Scan Configuration: Configure regions, platforms, scan types, scan interval, tag filters, and directory and secret-rule filters for the Service Account, and override them for individual Target Accounts.
• Network Access Options: Choose SERVICE_ENDPOINT (default) for lower cost and simpler deployment, or PRIVATE_ENDPOINT for maximum network isolation with no public endpoint exposure.
• Integrated Visibility: Vulnerability, SCA, and sensitive data findings are automatically available in TotalCloud.

Prerequisites: An active Qualys TotalCloud subscription with the Zero-touch Snapshot-based Scan for Azure feature enabled.

How to Enable Snapshot-based Scan for Azure with Qualys Native Deployment

• Deploy the provided Terraform configuration with deploy_flexscan = true to provision the required resources and permissions in the Service Account subscription.
• Register the Service Account subscription with the "Register Service Account" API using cloudType AZURE, then configure the required scan-related settings with the "Setup Service Account" API. All scans run under the configured Service Account.
• After the Service Account is registered, enable the "Zero-touch Snapshot Based Scan" option in the connector configuration for the target subscriptions.
  Optionally, use the "Setup Target Account" API to override scan settings for individual target accounts.

Contact your Technical Account Manager (TAM) or Qualys Support to activate this feature. Existing deployments that use the Bicep binaries continue to be supported.

For more information, refer to Configure Zero-touch Snapshot-based Scan for Azure.