Installsensor Shell Script Command Line Parameters

ActivationId

ConcurrentScan

CpuShares

CustomerId

The Qualys subscription’s customer Id, auto-generated based on your subscription.

--cicd-deployed-sensor or -c

Run the sensor in a CI/CD environment. This allows you to scan images on CI/CD pipeline (Jenkins, Bamboo).

This parameter should be passed if you want to disable image scans for General Sensor. Images will not be scanned by sensors deployed with this option. This is available for General sensor type only, and is available for all Runtimes (Docker, CRI-O and Containerd).

--disable-log4j-scanning

This parameter should be passed if you want to disable log4j vulnerability scanning for container images.
See Log4j vulnerability scanning.

--disable-log4j-static-detection

This parameter should be passed if you want to disable log4j static detection for dynamic/static image scans. See Static log4j detection.

DockerHost

The address on which the docker daemon is configured to listen. This option is mandatory if DOCKER_TLS_VERIFY=1 is defined.

DockerHost format: <Docker daemon host’s IPv4 address, or FQDN, or hostname>:<port#>

DockerSocketDirectory

Docker socket directory path. The default value is Default: /var/run

DOCKER_TLS_VERIFY

This parameter enables the TLS authentication. The value should be 0 or 1.

If DOCKER_TLS_VERIFY=1 is defined, then ensure that the provided IPv4 address or FQDN or hostname in DockerHost matches either the CN or the Alternative Subject Name in the docker server certificate.

By enabling sensor communication with docker daemon over TLS, customer can restrict the sensor’s access to docker socket by using docker authorization plugin.

--enable-console-logs

HostIdSearchDir

ImageFile

LogFilePurgeCount

Integer value that specifies the maximum number of archived log files. Default value is 5.

LogFileSize

Configuration to set the maximum size per log file for the sensor in bytes. Accepts "<digit><K/M/>" where K is kilobytes and M is megabytes. For example, specify "10" for 10 bytes, "10K" for 10 kilobytes, "10M" for 10 megabytes. Default value is "10M".

LogLevel

Configuration to set the logging level for sensor, accepts 0 to 5. Default value is 3 (Information).

--limit-resource-usage

Use this parameter to limit usage of resources for SCA/Secret/Malware Scan

--mask-env-variable

Use this parameter to mask environment variables for images and containers. The environment variables will be masked/removed in sensor logs and in the Container Security UI.

MemoryUsageLimit

Define the memory usage limit for the sensor container. The value should be formatted as <digit><unit> where unit can be any of the following: b (bytes), k (kilobytes), m (megabytes), g (gigabytes). The recommended value is 500m for 500 megabytes.

--optimize-image-scans

This parameter should be passed if you want to optimize Image scans for General Sensor. This is available for General sensor type only.

By default, the sensor scans every image that it detects on the host. This results in redundant scanning of images. When you install the General sensor with “--optimize-image-scans”, the sensor will communicate with the Qualys Cloud Platform and perform informed scans to avoid redundant image scans. The sensor will determine if the images present on the host are already scanned by other sensors for the same manifest and version and will not scan those images again.

--perform-secret-detection

Use this parameter to enable secret detection for container images. You can specify a timeout for this command using the SCAScanTimeoutInSeconds={value} parameter.

Secret detection is supported only on:
- CICD and registry sensors
- Linux operating system
- Docker, Containerd, and CRI-O runtimes

PidLimit

Define the PID limit for the sensor container. The value provided must be a positive integer.

Proxy

IPv4/IPv6 address or FQDN of the proxy server.

ProxyCertFile

Proxy certificate file path. ProxyCertFile is applicable only if the Proxy has a valid certificate file. If this option is not provided, then Sensor will try to connect to the server with the given https Proxy settings only.

If only ProxyCertFile is provided without Proxy then Sensor would simply ignore the ProxyCertFile and it would try to connect to the server without any https proxy settings.

• DynamicWithStaticScanningAsFallback: (Default value). Performs static scanning as a fallback to dynamic scanning for images without shell.
• DynamicScanningOnly: performs only dynamic scanning.
• StaticScanningOnly: performs only static scanning.
  For example, 'scanningPolicy=podman'

--sensor-without-persistent-storage

Use this option to run the sensor without using persistent storage on the host.

The sensor should be run either with the “--sensor-without-persistent-storage” option OR with the “--read-only” option and not with both options enabled together.

To install the sensor without persistent storage, exclude the 'Storage' option, and include the '--sensor-without-persistent-storage' option in the installer script. We recommend you use the '--enable-console-logs' option along with '--sensor-without-persistent-storage' to preserve the logs as data is not available on host but stored at the /usr/local/qualys/qpa/data folder relative to the Sensor.

As the sensor is running with '--sensor-without-persistent-storage', upon auto-update the updated sensor is a completely new instance of sensor container hence data from the old sensor is not available in the new sensor. Thus, the new sensor re-scans the existing scanned assets.

• 'overlay' applicable only with Podman runtime.
  For example, 'StorageDriverType=overlay'
• 'overlay2' applicable only with Docker runtime.
  For example, 'StorageDriverType=overlay2'

tlscacert=<Name of CA (default "ca.pem")> tlscert=<Name of TLS certificate file (default "cert.pem")> tlskey=<Name of TLS key file (default "key.pem")>

If any of the CA certificate, client certificate, or client private key have default file names such as ca.pem, cert.pem, key.pem respectively they can be omitted.

Parameter

Description

--perform-sca-scan

(Optional when SCA scanning is enabled for your subscription) By default, SCA scanning is not performed. Use this parameter to enable SCA scanning for container images. When specified, the SCA scan will be performed after a standard vulnerability scan (Static or Dynamic). The SCA scan is attempted even when the vulnerability scan is not successful.

--disallow-internet-access-for-sca

(Optional when --perform-sca-scan is specified) By default, Internet access is enabled for the SCA scan and the SCA scan is performed in online mode because in online mode, the package collection is more accurate than compared to scans performed in offline mode. Use this parameter to disable Internet access for the SCA scan and run the scan in offline mode instead.

We recommend you run the SCA scan in online mode. Quality of software package enumeration for Java substantially degrades when the SCA scan is run in offline mode. The remote maven repository may need to be consulted for an accurate package detection. This can affect accuracy of the vulnerability posture of the image. The sensor must be able to reach the URL “http://search.maven.org” and “https://ghcr.io”.

SCAScanTimeoutInSeconds={value}

(Optional when --perform-sca-scan is specified) The default SCA scan command timeout is 5 minutes (300 seconds). Use this parameter to overwrite the default timeout with a new value specified in seconds. For example, you may need to increase the SCA scan timeout when scanning large container images to ensure the SCA scan has time to finish.

This parameter is also used for specifying a timeout for secret detection.

--limit-resource-usage   

(Optional) Use this parameter to limit the usage of resources for SCA/Secret/Malware Scan.

POD_URL