Serverless Functions
Qualys Container Security provides visibility into serverless functions deployed across your cloud environments. You can view scanned serverless functions from Container Security > Assets > Serverless Functions.
The Serverless Functions tab provides a centralized inventory of functions scanned by Qualys, including both container image-based and ZIP/deployment package-based functions. For each function, Qualys identifies vulnerabilities and software dependencies and provides risk context to help you prioritize remediation.
Qualys currently supports AWS Lambda and Microsoft Azure Functions.
View Serverless Functions
Go to Container Security > Assets > Serverless Functions to view the serverless functions discovered and scanned by Qualys.
The Serverless Functions page provides information about each function such as:
- Function name and cloud provider
- Cloud account or subscription
- Region
- Runtime and architecture
- Package type, such as 'Image' or 'ZIP'
- Installed software
- Vulnerability findings
- TruRisk™ Score
- Last scan information
For image-based functions, Qualys also maintains the association between the serverless function and the underlying container image, helping you correlate function risk with the exact image deployed.
Select a serverless function to view additional information about the function, its installed software, vulnerabilities, and associated risk.
Supported Serverless Functions & Scan Types
The following table summarizes the serverless platforms, deployment types, and security assessments supported by Qualys.
| Cloud Provider | Serverless Service | Deployment Type | OS Package Vulnerabilities* | Software Composition Analysis (SCA)** | Misconfigurations |
|---|---|---|---|---|---|
| AWS | AWS Lambda | Container Image | ✓ | ✓ | ✓ (Through CSPM) |
| AWS | AWS Lambda | ZIP Package | N/A / package dependent | ✓ | ✓ (Through CSPM) |
| Microsoft Azure | Azure Functions | Container Image | ✓ | ✓ | ✓ (Through CSPM) |
| Microsoft Azure | Azure Functions | ZIP Deployment | ✓ for detected OS packages | ✓ | ✓ (Through CSPM) |
*OS Package Vulnerabilities identify vulnerabilities associated with operating system packages detected within the scanned function artifact.
**Software Composition Analysis (SCA) identifies open-source and language-specific packages and their associated vulnerabilities. This includes supported packages from ecosystems such as Java, Python, Node.js, .NET, Go, PHP, Ruby, and Rust.
Note: Serverless function vulnerability and SCA assessments are performed by Qualys Container Security. Cloud configuration and posture-related misconfigurations for AWS Lambda and Azure Functions are evaluated by Qualys Cloud Security (CSPM) and are not generated by the Container Security serverless scan itself.
AWS Lambda Functions
Qualys Container Security supports AWS Lambda functions deployed using:
- Container Images
- ZIP Packages
- x86_64 architecture
- ARM64 architecture
After AWS Lambda scanning is configured, Qualys can automatically discover and assess Lambda functions across configured AWS accounts and regions. New and updated Lambda functions can be detected and scanned automatically.
Scan results are available from: Container Security > Assets > Serverless Functions
To know more, refer to Serverless Lambda Function Scan.
Microsoft Azure Functions
Qualys Container Security supports Microsoft Azure Functions deployed using:
- Container Images
- ZIP deployment packages
Azure Functions are scanned using QScanner. Qualys analyzes the function package to identify installed OS and non-OS software, vulnerabilities, and SCA findings, and uploads the results to the Qualys Enterprise TruRisk™ Platform.
Pre-requisites for Scanning Microsoft Azure Functions
Before scanning Azure Functions, ensure that you have:
- Azure Subscription ID
- Azure Tenant ID
- Azure Client ID
- Azure Client Secret
- Qualys authentication credentials for QScanner
Connectivity from QScanner to the required Azure and Qualys endpoints
Scan results are available from: Container Security > Assets > Serverless Functions
Serverless Function Data Retention
You can configure how long Qualys retains serverless function records.
Go to: Container Security > Configurations > General > Data Retention Settings > Serverless Functions
You can configure a retention period between 7 and 30 days.
Serverless function assets that are not updated within the configured retention period are automatically removed from the inventory.