QCS Sensor Operational Phases
The QCS Sensor lifecycle includes Initialization, Activation, Connection, Discovery, Metadata Collection, Vulnerability Assessment, and Continuous Monitoring. You can validate functionality using logs, container status, and Qualys UI (Qualys Enterprise TruRisk™ Platform).
Once deployed, the CS Sensor goes through the following key phases:
- Initialization Phase
- Activation & Registration Phase
- Connection & Heartbeat Phase
- Discovery Phase
- Metadata Collection Phase
- Vulnerability Assessment Phase
- Continuous Monitoring Phase
1. Initialization Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Sensor container/pod starts.
- Required components are initialized.
- Environment variables (Activation ID, Customer ID, and so on.) are validated.
- Configuration (proxy, registry access, cluster config) is loaded.
Customer Validation
- Check container/pod status:
docker ps | grep qualys
or (Kubernetes):
kubectl get pods -n qualys - Ensure container status or POD status is Running.
2. Activation Registration Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Sensor authenticates with the Qualys Enterprise TruRisk™ Platform.
- Activation ID and Customer ID are verified.
- Sensor gets registered.
Customer Validation
Check logs for:
- Successful activation messages
- No authentication errors
- Log indicator example:
"Agent provisioning successful"
In Qualys Enterprise TruRisk™ Platform,
- Navigate to Container Security > Sensors
- Confirm the sensor appears with a status as 'Running'
3. Connection & Heartbeat Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Sensor establishes persistent communication with Qualys Enterprise TruRisk™ Platform.
- Heartbeat signals are sent periodically.
Customer Validation
Logs should show periodic communication messages
- Sending heartbeat
- Heartbeat successful
In Qualys Enterprise TruRisk™ Platform,
- Sensor status should remain Connected/Healthy
- Sensor status shows last checked-in timestamp
4. Discovery Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Sensor scans the host or Kubernetes node.
- Discovers:
Running containers
Container images - Identifies container runtime (Docker, containerd, CRI-O, etc.)
Customer Validation
Logs show discovery activity:
Discovering containers
Found X containers
In Qualys Enterprise TruRisk™ Platform,
- Go to Assets > Containers / Images
- Verify:
Running containers are listed
Images are being populated
5. Metadata Collection Phase
In this phase, the Qualys CS Sensor collects detailed metadata such as,
- OS details
- Installed packages
- Image layers
- Labels, tags, namespaces
Customer Validation
Logs:
Collecting metadata for container <id>
In the Qualys Enterprise TruRisk™ Platform,
Container/Image details page shows:
- OS and package inventory
- Labels and tags
6. Vulnerability Assessment Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Data sent to Qualys backend.
- Backend performs vulnerability analysis.
Customer Validation
- Navigate to Vulnerabilities → Containers/Images.
- Verify CVEs are listed.
- Log messages:
Uploading metadata
Scan request submitted
7. Continuous Monitoring Phase
In this phase, the Qualys CS Sensor follows the sequence below.
- Continuously monitors new containers and changes.
- Continuously monitors new containers and images and container’s status change.
Customer Validation
New container appears in Qualys Enterprise TruRisk™ Platform.
End-to-End Validation Checklist
| Validation Area | Expected Result |
|---|---|
| Sensor container/pod | Running, no restarts |
| Activation | Successful registration |
| UI visibility | Sensor listed in Qualys Enterprise TruRisk™ Platform |
| Connectivity | Heartbeat and updated timestamps |
| Discovery | Containers and images visible |
| Metadata | Detailed asset data available |
| Vulnerabilities | CVEs displayed |
| Continuous updates | New containers detected |
Troubleshooting
Some troubleshooting points related to QCS Sensor phases are listed below.
- Sensor not visible: Verify Activation ID and connectivity.
- No containers discovered: Check runtime access and permissions.
- No vulnerabilities: Wait for backend processing.
- Frequent restarts: Check logs and resource limits.