Home

Create Reports in Container Security

You can create customizable, QQL-query-driven, on-demand and scheduled report jobs. Reports are driven by report templates. You can create the following report templates: Image Vulnerability Report, Container Vulnerability Report, Image Secrets Report, and Image Malware Report. When your report is finished, you can download it in CSV format from the Reports list.

  1. In the Reports tab, click Create Report.

    Under Report Details, enter a name and description for the new report. If you want to compress the generated report, select Compress the generated report checkbox and click Next. 

  2. Under Report Source, select a report template:
    • Image Vulnerability: Creates a vulnerability report on your scanned images.
    • Image Secrets: Creates a secrets report on your scanned images.
    • Container Vulnerability: Creates a vulnerability report on your scanned containers.
    • Image Malware: Creates a malware report on your scanned images.
    • Compliance: Creates a compliance report listing containers evaluated against configured compliance policies, including pass/fail status per control.
    • Images: Creates an asset inventory report listing all scanned images with their metadata, scan status, and vulnerability summary.
    • Containers: Creates an asset inventory report listing all running containers with their metadata, scan status, and associated image details.
    • Pods: Creates an asset inventory report listing Kubernetes pods with their associated namespace, cluster, and container details.
    • Vulnerability: Creates a consolidated vulnerability report across scanned images or containers, listing QIDs, severity, and patch availability.
    • Image Softwares: Creates a software inventory report listing software packages detected on scanned images, including version and lifecycle status.

  3. (Optional) Specify a QQL search query to limit the report to only certain images or containers. For Image Secrets report template, you can click Add Secret Query and specify the secrets query which you want to search. For Image Malware report template, you can click Add Malware Query to specify the malware query you want to search. 
    Only the images or containers that match your query are included in the report. For example, apply a search query to focus on a particular scope or time-frame. Reports with a large number of records are truncated and this is indicated in the report.

    After providing your query, click Next to continue.

    To learn more about search tokens, see Searching Images | Searching Containers

  4. Under Report Schedule, specify whether you want to create an on-demand report or a scheduled report. You can immediately generate a report using Run Now option. 

    For a scheduled report, you need to define a schedule using Single Occurrence or Recurring to run the report at specified time or at regular intervals. You can create a daily, weekly, or monthly recurring schedule. 

    Specify the date and time based on the UTC timezone.

    Non-recurrent report scheduled at a future date and timeNon-recurrent report scheduled at a future date and time

    To create a non-recurrent report scheduled at a future date and time, use the Single Occurrence option and specify the start date and time.

    Daily recurring reportDaily recurring report

    To create a daily recurring report:

    1. Select the Recurring option.

    2. Choose Daily from the Repeats dropdown.

    3. Specify the start date and time, and the end date and time for the schedule. The schedule runs within this specified timeframe.

    Weekly recurring reportWeekly recurring report

     To create a weekly recurring report:

    1. Select the weekly frequency and then select a day of the week on which you want the report to run.

    2. Specify the start date and time, and the end date and time for the schedule. The schedule runs within this specified timeframe.

    Monthly recurring reportMonthly recurring report

     To create a monthly recurring report:

    1. Select the monthly frequency.

    2. Define the schedule using either of the following methods:

      • Select a day of the month between 1 to 31. For example, 12. The report runs on the 12th day of every month.

      • Select a week and then a day of the week. For example, Sunday of the second week. The report runs every second Sunday of the month.

    3. Specify the start date and time, and the end date and time for the schedule. The schedule runs within this specified timeframe.

  5. Select the Email Notification checkbox if you want to notify the recipients about the report. 
  6. In Receive Report, choose one of the following options.
    • URL - Sends an URL of the report. The URL takes the email recipients to Qualys Enterprise TruRisk™ Platform. Recipients who have a Qualys account can access the report using the URL.
    • CSV Attachment - Attaches the report (.csv) to the email. If your report size is more than 15MB, then, by default, it is sent using the URL method.
  7. From the Report expires in list, select a time period after which the report expires and gets deleted from your account.
  8. Under Report Display, choose the details you want to see in your report. Your selections determine which columns appear in the CSV report output. Note that certain details are selected by default and cannot be cleared. Optionally, select Select All to include all details in the report.


    The image above shows you Report Display page of an Image Malware report.

    Select a report type to view the available display fields:

    Image Vulnerability reportImage Vulnerability report

    Standard Attributes

    Field Description
    REPOSITORY The repository within the registry where the image is stored.
    IMAGE ID The Docker image ID. Mandatory — always included.
    SHA The SHA256 digest of the image.
    IMAGE UUID Unique identifier for the image in Qualys CS.
    IMAGE LABEL Docker labels assigned to the image.
    TRURISK SCORE The Qualys TruRisk score representing the image's overall risk.
    TAGS Qualys tags assigned to the image.
    CREATED ON The date and time the image was created.
    UPDATED The date and time the image record was last updated in CS.
    OS The base operating system of the image.
    QID The Qualys vulnerability ID. Mandatory — always included.
    TITLE The title of the vulnerability.
    QDS The Qualys Detection Score — a risk-adjusted score for the vulnerability.
    SEVERITY The severity level of the vulnerability (Critical, High, Medium, Low, or Informational).
    CVE ID The CVE identifier(s) associated with the vulnerability.
    VENDOR REFERENCE The vendor advisory or bulletin reference for the vulnerability.
    CVSS BASE The CVSS v2 base score of the vulnerability.
    CVSS TEMPORAL The CVSS v2 temporal score, adjusted for current exploit availability and remediation.
    CVSS3 BASE The CVSS v3 base score of the vulnerability.
    CVSS3 TEMPORAL The CVSS v3 temporal score, adjusted for current exploit availability and remediation.
    THREAT The threat level associated with the vulnerability.
    IMPACT The potential impact of exploiting the vulnerability.
    SOLUTION The recommended remediation or mitigation for the vulnerability.
    EXPLOITABILITY Indicates the ease and technical means by which the vulnerability can be exploited.
    ASSOCIATED MALWARE Malware families known to exploit this vulnerability.
    CATEGORY The vulnerability category (for example, Buffer Overflow or SQL Injection).
    SOFTWARE DETAILS Details of the software package affected by the vulnerability.
    RESULT The scan evidence that confirmed the presence of the vulnerability.
    FIRST DETECTED The date and time the vulnerability was first detected on the image.
    IS QID EXEMPTED Indicates whether this vulnerability has been exempted from reporting.
    RHSA ID The Red Hat Security Advisory (RHSA) ID associated with the vulnerability.
    RHSA SEVERITY The severity rating assigned to the vulnerability by Red Hat.
    RHSA CVE SEVERITY The CVE severity as rated by Red Hat in the associated RHSA.
    RHSA CVE CVSS2 BASE SCORE The CVSS v2 base score assigned by Red Hat in the associated RHSA.
    RHSA CVE CVSS3 BASE SCORE The CVSS v3 base score assigned by Red Hat in the associated RHSA.
    IS SCA Indicates whether the vulnerability was detected by Software Composition Analysis (SCA).
    PUBLISHED DATE The date the vulnerability was publicly disclosed.
    EXCEPTION NAMES The names of any vulnerability exceptions applied to this finding.

    Real-time Threat Indicators

    Field Description
    EASY EXPLOIT Indicates that an exploit for the vulnerability is easy to execute.
    NO PATCH Indicates that no patch is currently available for the vulnerability.
    ACTIVE ATTACKS Indicates that the vulnerability is actively being exploited in the wild.
    HIGH LATERAL MOVEMENT Indicates that the vulnerability can be used for lateral movement within a network.
    HIGH DATA LOSS Indicates that exploitation of this vulnerability may result in significant data loss.
    DENIAL OF SERVICE Indicates that the vulnerability can be used to launch a denial of service attack.
    WORMABLE Indicates that the vulnerability can be exploited by self-propagating malware.
    PREDICTED HIGH RISK Indicates that the vulnerability is predicted to be highly exploitable based on threat intelligence.
    PRIVILEGE ESCALATION Indicates that the vulnerability can be used to escalate privileges on the affected system.
    UNAUTHENTICATED EXPLOITATION Indicates that the vulnerability can be exploited without authentication.
    REMOTE CODE EXECUTION Indicates that the vulnerability allows an attacker to execute arbitrary code remotely.
    RANSOMWARE Indicates that the vulnerability has been associated with ransomware attacks.
    SOLORIGATE SUNBURST Indicates that the vulnerability is associated with the SolarWinds Solorigate/SUNBURST attack campaign.
    CISA KNOWN EXPLOITED VULNS Indicates that the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
    ZERO DAY Indicates that the vulnerability was actively exploited before a patch was publicly available.
    EXPLOIT PUBLIC Indicates that a public exploit for the vulnerability is available.
    MALWARE Indicates that the vulnerability has been associated with malware campaigns.
    EXPLOIT KIT Indicates that the vulnerability is included in known exploit kits.

    Image Secrets reportImage Secrets report

    Secrets Attributes

    Field Description
    REPOSITORY The repository within the registry where the image is stored.
    IMAGE ID The Docker image ID. Mandatory — always included.
    SHA The SHA256 digest of the image.
    IMAGE UUID Unique identifier for the image in Qualys CS.
    IMAGE LABEL Docker labels assigned to the image.
    CREATED ON The date and time the image was created.
    OS The base operating system of the image.
    UPDATED ON The date and time the image record was last updated in CS.
    SECRET UUID Unique identifier for the secret finding in Qualys CS. Mandatory — always included.
    SEVERITY The severity level assigned to the detected secret.
    LAYER SHA The SHA of the image layer where the secret was detected.
    SECRET DETECTOR UUID The UUID of the detector rule that identified the secret.
    SECRET FILE PATH The file path within the image layer where the secret was detected.
    SECRET LAST UPDATED The date and time the secret record was last updated.
    SECRET CATEGORY The category of the detected secret (for example, Credentials or API Key).
    SENSITIVE DATA TYPE The type of sensitive data detected (for example, Credit Card Number or SSN).
    SECRET MATCHES The number of pattern matches found by the secret detector rule.

    Container Vulnerability reportContainer Vulnerability report

    Standard Attributes

    Field Description
    CONTAINER NAME The name assigned to the container.
    CONTAINER ID The Docker-assigned container ID. Mandatory — always included.
    CONTAINER UUID Unique identifier for the container in Qualys CS.
    TRURISK SCORE The Qualys TruRisk score representing the container's overall risk.
    IMAGE ID The Docker image ID associated with the running container.
    REPOSITORY The repository of the image running in the container.
    TAGS Qualys tags assigned to the container.
    CREATED ON The date and time the container was created.
    HOST NAME The hostname of the host on which the container is running.
    HOST IP The IP address of the host running the container.
    HOST ARCHITECTURE The CPU architecture of the host (for example, amd64 or arm64).
    STATE The current runtime state of the container (for example, Running or Stopped).
    STATE CHANGED The date and time the container state last changed.
    LAST SCANNED The date and time the container was last scanned.
    UPDATED The date and time the container record was last updated in CS.
    QID The Qualys vulnerability ID. Mandatory — always included.
    QDS The Qualys Detection Score — a risk-adjusted score for the vulnerability.
    TITLE The title of the vulnerability.
    SEVERITY The severity level of the vulnerability (Critical, High, Medium, Low, or Informational).
    CVE ID The CVE identifier(s) associated with the vulnerability.
    VENDOR REFERENCE The vendor advisory or bulletin reference for the vulnerability.
    CVSS BASE The CVSS v2 base score of the vulnerability.
    CVSS TEMPORAL The CVSS v2 temporal score, adjusted for current exploit availability and remediation.
    CVSS3 BASE The CVSS v3 base score of the vulnerability.
    CVSS3 TEMPORAL The CVSS v3 temporal score, adjusted for current exploit availability and remediation.
    THREAT The threat level associated with the vulnerability.
    IMPACT The potential impact of exploiting the vulnerability.
    SOLUTION The recommended remediation or mitigation for the vulnerability.
    EXPLOITABILITY Indicates the ease and technical means by which the vulnerability can be exploited.
    ASSOCIATED MALWARE Malware families known to exploit this vulnerability.
    CATEGORY The vulnerability category (for example, Buffer Overflow or SQL Injection).
    SOFTWARE DETAILS Details of the software package affected by the vulnerability.
    FIRST DETECTED The date and time the vulnerability was first detected on the container.
    IS QID EXEMPTED Indicates whether this vulnerability has been exempted from reporting.
    RHSA ID The Red Hat Security Advisory (RHSA) ID associated with the vulnerability.
    RHSA SEVERITY The severity rating assigned by Red Hat.
    RHSA CVE CVSS2 BASE SCORE The CVSS v2 base score assigned by Red Hat in the associated RHSA.
    RHSA CVE CVSS3 BASE SCORE The CVSS v3 base score assigned by Red Hat in the associated RHSA.
    OS The operating system of the container image.
    IS SCA Indicates whether the vulnerability was detected by Software Composition Analysis (SCA).
    PUBLISHED DATE The date the vulnerability was publicly disclosed.
    EXCEPTIONS Vulnerability exceptions applied to findings on this container.

    Cloud Attributes

    Field Description
    CLOUD PROVIDER The cloud service provider hosting the container (for example, AWS, Azure, or GCP).
    REGION The cloud region where the container is running.
    CLOUD ACCOUNT The cloud account ID associated with the container.
    CLUSTER ID The unique identifier of the Kubernetes cluster.

    Kubernetes Attributes

    Field Description
    CLUSTER NAME The name of the Kubernetes cluster running the container.
    POD NAMESPACE The Kubernetes namespace in which the pod is deployed.
    NAMESPACE LABELS Labels assigned to the Kubernetes namespace.
    NAMESPACE ANNOTATIONS Annotations applied to the Kubernetes namespace.
    POD NAME The name of the pod running the container.
    POD UUID The unique identifier of the pod.
    POD LABEL Labels assigned to the pod.
    POD CONTROLLER The Kubernetes controller managing the pod (for example, Deployment or DaemonSet).
    DEPLOYMENT UUID The UUID of the Kubernetes Deployment managing the pod.
    DEPLOYMENT NAME The name of the Kubernetes Deployment managing the pod.
    NODE NAME The name of the Kubernetes node running the pod.
    NODE IS MASTER Indicates whether the node is a Kubernetes control plane (master) node.

    Real-time Threat Indicators

    Field Description
    EASY EXPLOIT Indicates that an exploit for the vulnerability is easy to execute.
    NO PATCH Indicates that no patch is currently available for the vulnerability.
    ACTIVE ATTACKS Indicates that the vulnerability is actively being exploited in the wild.
    HIGH LATERAL MOVEMENT Indicates that the vulnerability can be used for lateral movement within a network.
    HIGH DATA LOSS Indicates that exploitation of this vulnerability may result in significant data loss.
    DENIAL OF SERVICE Indicates that the vulnerability can be used to launch a denial of service attack.
    WORMABLE Indicates that the vulnerability can be exploited by self-propagating malware.
    PREDICTED HIGH RISK Indicates that the vulnerability is predicted to be highly exploitable based on threat intelligence.
    PRIVILEGE ESCALATION Indicates that the vulnerability can be used to escalate privileges on the affected system.
    UNAUTHENTICATED EXPLOITATION Indicates that the vulnerability can be exploited without authentication.
    REMOTE CODE EXECUTION Indicates that the vulnerability allows an attacker to execute arbitrary code remotely.
    RANSOMWARE Indicates that the vulnerability has been associated with ransomware attacks.
    SOLORIGATE SUNBURST Indicates that the vulnerability is associated with the SolarWinds Solorigate/SUNBURST attack campaign.
    CISA KNOWN EXPLOITED VULNS Indicates that the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
    ZERO DAY Indicates that the vulnerability was actively exploited before a patch was publicly available.
    EXPLOIT PUBLIC Indicates that a public exploit for the vulnerability is available.
    MALWARE Indicates that the vulnerability has been associated with malware campaigns.
    EXPLOIT KIT Indicates that the vulnerability is included in known exploit kits.

    Image Malware reportImage Malware report

    Malware Attributes

    Field Description
    REPOSITORY The repository within the registry where the image is stored.
    IMAGE ID The Docker image ID. Mandatory — always included.
    SHA The SHA256 digest of the image.
    IMAGE UUID Unique identifier for the image in Qualys CS.
    IMAGE LABEL Docker labels assigned to the image.
    CREATED ON The date and time the image was created.
    OS The base operating system of the image.
    UPDATED ON The date and time the image record was last updated in CS.
    IMAGE MALWARE SEVERITY The overall severity of malware detected on the image. Mandatory — always included.
    IMAGE MALWARE SCORE The malware risk score assigned to the image.
    IMAGE MALWARE PREDICTION The predicted malware risk level for the image based on analysis.
    IMAGE MALWARE CATEGORY The category of malware detected on the image (for example, Trojan or Ransomware).
    IMAGE MALWARE FAMILY The malware family identified on the image.
    IMAGE MALWARE COUNT The total number of malware findings detected on the image.
    IMAGE LAST SCAN DATE The date and time the image was last scanned for malware.
    IMAGE LAYERS ANALYZED The number of image layers analyzed during the malware scan.
    IMAGE FILES ANALYZED The total number of files analyzed across all image layers.
    LAYER SHA The SHA of the image layer containing the malware finding.
    LAYER COMMAND The Dockerfile instruction that created the layer containing the malware.
    LAYER FILE NAME The name of the file where malware was detected within the layer.
    LAYER MIME TYPE The MIME type of the file where malware was detected.
    LAYER FILES ANALYZED The number of files analyzed within the specific layer.
    LAYER CREATED DATE The date and time the layer was created.
    LAYER MALWARE SEVERITY The malware severity for findings within the specific layer.
    LAYER MALWARE SCORE The malware risk score for the specific layer.
    LAYER MALWARE PREDICTION The predicted malware risk level for the specific layer.
    LAYER MALWARE CATEGORY The category of malware detected in the specific layer.
    LAYER MALWARE FAMILY The malware family identified in the specific layer.

    Compliance reportCompliance report

    KSPM Attributes

    Field Description
    CID The unique control identifier in the KSPM framework. Mandatory — always included.
    CIS RECOMMENDATION The CIS Benchmark recommendation associated with the control.
    CONTROL TITLE The title of the KSPM control being evaluated.
    CRITICALITY The criticality level of the control (for example, Critical, High, Medium, or Low). Mandatory — always included.
    RESOURCE TYPE The type of Kubernetes resource evaluated (for example, Pod, Node, or Namespace).
    RATIONALE The reason the control is important for security.
    RESOURCE NAME The name of the Kubernetes resource evaluated against the control. Mandatory — always included.
    STATUS The evaluation result for the control: Pass or Fail. Mandatory — always included.
    CLUSTER NAME The name of the Kubernetes cluster where the resource resides.
    CLUSTER VERSION The Kubernetes version of the cluster.
    EVIDENCE (FAILED PATHS) The configuration paths or values that caused the control to fail.
    REMEDIATION PATH (FIX PATHS) The configuration paths that need to be updated to remediate the finding.
    REMEDIATION Recommended steps to address the failed control.
    FIRST SCANNED The date and time the resource was first evaluated against this control.
    LAST SCANNED The date and time the resource was most recently evaluated against this control.

    Images reportImages report

    Image Attributes

    Field Description
    IMAGE UUID Unique identifier for the image in Qualys CS. Mandatory — always included.
    IMAGE SHA The SHA256 digest of the image. Mandatory — always included.
    IMAGE ID The Docker image ID. Mandatory — always included.
    PARENT UUID The UUID of the parent image from which this image was derived.
    CREATED ON The date and time the image was created.
    UPDATED The date and time the image record was last updated in CS.
    REPOSITORY The repository within the registry where the image is stored.
    REPO DIGEST The digest of the image as stored in its repository.
    LABEL Docker labels assigned to the image.
    OPERATING SYSTEM The base operating system of the image.
    ARCHITECTURE The CPU architecture the image was built for (for example, amd64 or arm64).
    USERS The user accounts defined within the image.
    LAST SCANNED The date and time the image was last scanned.
    SOURCE The discovery source for the image (for example, registry or runtime sensor).
    IS DOCKER HUB OFFICIAL Indicates whether the image is an official Docker Hub image.
    SCAN TYPES The scan types performed on the image (for example, Vulnerability, Malware, SCA).
    SCAN STATUS The current scan status of the image (for example, Scanned or Not Scanned).
    TAGS Qualys tags assigned to the image.
    TRURISK SCORE The Qualys TruRisk score representing the image's overall risk.
    TRURISK SCORE CALCULATED The date and time the TruRisk score was last calculated.
    BASE IMAGE The base image used to build this image.
    DETECTED SENSITIVE DATA COUNT The number of sensitive data findings detected on the image.
    DETECTED MALWARE COUNT The number of malware findings detected on the image.
    VULN COUNT The total number of vulnerabilities detected on the image.
    VULN COUNT WITH SEVERITY A breakdown of vulnerability counts by severity level (Critical, High, Medium, Low).
    COMPLIANCE The compliance evaluation status of the image.

    Containers reportContainers report

    Container Attributes

    Field Description
    CONTAINER NAME The name assigned to the container.
    CONTAINER UUID Unique identifier for the container in Qualys CS. Mandatory — always included.
    CONTAINER ID The Docker-assigned container ID. Mandatory — always included.
    CONTAINER SHA The SHA identifier of the container. Mandatory — always included.
    IMAGE SHA The SHA digest of the image the container was launched from.
    IMAGE ID The Docker image ID associated with the running container.
    CREATED ON The date and time the container was created.
    UPDATED The date and time the container record was last updated in CS.
    STATE The current runtime state of the container (for example, Running or Stopped).
    STATE CHANGED The date and time the container state last changed.
    PRIVILEGED Indicates whether the container is running in privileged mode.
    CONTAINER LABELS Docker labels assigned to the container.
    HOST NAME The hostname of the host on which the container is running.
    HOST ARCHITECTURE The CPU architecture of the host (for example, amd64 or arm64).
    USERS The user accounts associated with the container process.
    OPERATING SYSTEM The operating system of the container image.
    LAST SCANNED The date and time the container was last scanned.
    SOURCES The discovery source for the container (for example, sensor or registry).
    IS ROOT Indicates whether the container process runs as the root user.
    TAGS Qualys tags assigned to the container.
    TRURISK SCORE The Qualys TruRisk score representing the container's overall risk.
    TRURISK SCORE CALCULATED The date and time the TruRisk score was last calculated.
    SCAN TYPES The scan types performed on the container (for example, Vulnerability, Compliance).
    IS CONTAINER EXPOSED OUTSIDE CLUSTER Indicates whether the container is exposed to traffic originating outside its Kubernetes cluster.
    IS CONTAINER EXPOSED TO WORLD Indicates whether the container is accessible from the public internet.
    SENSOR UUID The UUID of the CS sensor that discovered the container.
    VULNERABILITY COUNT The total number of vulnerabilities detected on the container.
    VULNERABILITY COUNT WITH SEVERITY A breakdown of detected vulnerability counts by severity level (Critical, High, Medium, Low).
    COMPLIANCE The compliance evaluation status of the container.

    Cloud Attributes

    Field Description
    CLOUD PROVIDER The cloud service provider hosting the container (for example, AWS, Azure, or GCP).
    REGION The cloud region where the container is running.
    CLOUD ACCOUNT The cloud account ID associated with the container.
    CLUSTER ID The unique identifier of the Kubernetes cluster.

    Kubernetes Attributes

    Field Description
    CLUSTER NAME The name of the Kubernetes cluster running the container.
    POD NAMESPACE The Kubernetes namespace in which the pod is deployed.
    NAMESPACE LABELS Labels assigned to the Kubernetes namespace.
    NAMESPACE ANNOTATIONS Annotations applied to the Kubernetes namespace.
    POD NAME The name of the pod running the container.
    POD UUID The unique identifier of the pod.
    POD LABEL Labels assigned to the pod.
    POD CONTROLLER The Kubernetes controller managing the pod (for example, Deployment or DaemonSet).
    NODE NAME The name of the Kubernetes node running the pod.
    NODE IS MASTER Indicates whether the node is a Kubernetes control plane (master) node.

    Pods reportPods report

    POD Attributes

    Field Description
    POD UUID Unique identifier for the pod in Qualys CS. Mandatory — always included.
    POD NAME The name of the Kubernetes pod.
    STARTED AT The date and time the pod was started.
    NAMESPACE The Kubernetes namespace in which the pod is deployed.
    CLUSTER ID The unique identifier of the Kubernetes cluster. Mandatory — always included.
    CLUSTER NAME The name of the Kubernetes cluster running the pod.
    CONTAINERS SHA The SHA identifiers of the containers running inside the pod.
    STATUS The current status of the pod (for example, Running, Pending, or Failed).
    UPDATED AT The date and time the pod record was last updated in CS.
    SENSOR UUID The UUID of the CS sensor that discovered the pod.
    LABELS Labels assigned to the pod.
    ANNOTATIONS Annotations applied to the pod.

    Vulnerability reportVulnerability report

    Vulnerability Attributes

    Field Description
    REPOSITORY The repository within the registry where the image is stored.
    IMAGE ID The Docker image ID. Mandatory — always included.
    SHA The SHA256 digest of the image. Mandatory — always included.
    IMAGE UUID Unique identifier for the image in Qualys CS.
    IMAGE LABEL Docker labels assigned to the image.
    TRURISK SCORE The Qualys TruRisk score representing the image's overall risk.
    TAGS Qualys tags assigned to the image.
    CREATED ON The date and time the image was created.
    UPDATED The date and time the image record was last updated in CS.
    OS The base operating system of the image.
    QID The Qualys vulnerability ID. Mandatory — always included.
    TITLE The title of the vulnerability.
    QDS The Qualys Detection Score — a risk-adjusted score for the vulnerability.
    SEVERITY The severity level of the vulnerability (Critical, High, Medium, Low, or Informational).
    CVE ID The CVE identifier(s) associated with the vulnerability.
    VENDOR REFERENCE The vendor advisory or bulletin reference for the vulnerability.
    CVSS BASE The CVSS v2 base score of the vulnerability.
    CVSS TEMPORAL The CVSS v2 temporal score, adjusted for current exploit availability and remediation.
    CVSS3 BASE The CVSS v3 base score of the vulnerability.
    CVSS3 TEMPORAL The CVSS v3 temporal score, adjusted for current exploit availability and remediation.
    IMPACT The potential impact of exploiting the vulnerability.
    SOLUTION The recommended remediation or mitigation for the vulnerability.
    THREAT The threat level associated with the vulnerability.
    EXPLOITABILITY Indicates the ease and technical means by which the vulnerability can be exploited.
    ASSOCIATED MALWARE Malware families known to exploit this vulnerability.
    CATEGORY The vulnerability category (for example, Buffer Overflow or SQL Injection).
    SOFTWARE DETAILS Details of the software package affected by the vulnerability.
    RESULT The scan evidence that confirmed the presence of the vulnerability.
    FIRST DETECTED The date and time the vulnerability was first detected.
    IS QID EXEMPTED Indicates whether this vulnerability has been exempted from reporting.
    RHSA ID The Red Hat Security Advisory (RHSA) ID associated with the vulnerability.
    RHSA SEVERITY The severity rating assigned by Red Hat.
    RHSA CVE SEVERITY The CVE severity as rated by Red Hat.
    RHSA CVE CVSS2 BASE SCORE The CVSS v2 base score assigned by Red Hat in the associated RHSA.
    RHSA CVE CVSS3 BASE SCORE The CVSS v3 base score assigned by Red Hat in the associated RHSA.
    IS SCA Indicates whether the vulnerability was detected by Software Composition Analysis (SCA).
    PUBLISHED DATE The date the vulnerability was publicly disclosed.
    EXCEPTION NAMES The names of any vulnerability exceptions applied to this finding.
    VULNERABILITY UUID The unique identifier for this vulnerability finding in Qualys CS.
    BASE IMAGE The base image layer from which the vulnerability originates.
    LAYERS The image layer(s) where the vulnerable component is present.
    LAYERS COUNT The number of image layers affected by the vulnerability.
    OPERATING SYSTEM The operating system of the affected image or container.
    HOST The hostname of the host where the affected container was running.
    SOURCE The source of the vulnerability detection (for example, registry scan or runtime scan).
    IMAGE QLP The image Quick List Position — an ordering attribute for the image.
    IS INHERITED Indicates whether the vulnerability is inherited from a base image layer.
    IS DRIFT Indicates whether the vulnerability was introduced after the image was initially scanned (runtime drift).
    CONTAINER SHA The SHA of the container where the vulnerability was detected.
    PATCH AVAILABLE Indicates whether a patch is available for the vulnerability.

    Real-time Threat Indicators

    Field Description
    EASY EXPLOIT Indicates that an exploit for the vulnerability is easy to execute.
    NO PATCH Indicates that no patch is currently available for the vulnerability.
    ACTIVE ATTACKS Indicates that the vulnerability is actively being exploited in the wild.
    HIGH LATERAL MOVEMENT Indicates that the vulnerability can be used for lateral movement within a network.
    HIGH DATA LOSS Indicates that exploitation of this vulnerability may result in significant data loss.
    DENIAL OF SERVICE Indicates that the vulnerability can be used to launch a denial of service attack.
    WORMABLE Indicates that the vulnerability can be exploited by self-propagating malware.
    PREDICTED HIGH RISK Indicates that the vulnerability is predicted to be highly exploitable based on threat intelligence.
    PRIVILEGE ESCALATION Indicates that the vulnerability can be used to escalate privileges on the affected system.
    UNAUTHENTICATED EXPLOITATION Indicates that the vulnerability can be exploited without authentication.
    REMOTE CODE EXECUTION Indicates that the vulnerability allows an attacker to execute arbitrary code remotely.
    RANSOMWARE Indicates that the vulnerability has been associated with ransomware attacks.
    SOLORIGATE SUNBURST Indicates that the vulnerability is associated with the SolarWinds Solorigate/SUNBURST attack campaign.
    CISA KNOWN EXPLOITED VULNS Indicates that the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
    ZERO DAY Indicates that the vulnerability was actively exploited before a patch was publicly available.
    EXPLOIT PUBLIC Indicates that a public exploit for the vulnerability is available.
    MALWARE Indicates that the vulnerability has been associated with malware campaigns.
    EXPLOIT KIT Indicates that the vulnerability is included in known exploit kits.

    Image Softwares reportImage Softwares report

    Software Attributes

    Field Description
    SOFTWARE NAME The name of the software package detected on the image. Mandatory — always included.
    SOFTWARE VERSION The installed version of the software package. Mandatory — always included.
    SOFTWARE FIX VERSION The version that fixes the known vulnerability or lifecycle issue for this software package.
    IMAGE LAYER SHA The SHA of the image layer where the software package is installed.
    SOFTWARE SCAN TYPE The scan method used to detect the software (for example, OS Package or SCA).
    SOFTWARE PACKAGE PATH The file path where the software package is installed on the image.
    SOFTWARE LIFECYCLE GA DATE The General Availability date of the software version.
    SOFTWARE LIFECYCLE EOL DATE The End of Life date for the software version. Mandatory — always included.
    SOFTWARE LIFECYCLE EOS DATE The End of Support date for the software version. Mandatory — always included.
    SOFTWARE LIFECYCLE STAGE The current lifecycle stage of the software (for example, GA, EOS, or EOL).
    SOFTWARE LIFECYCLE CONFIDENCE The confidence level of the lifecycle stage determination.
    IMAGE REPOSITORY The repository of the image on which the software was detected.
    IMAGE LABEL Docker labels assigned to the image containing the software.
    IMAGE ID The Docker image ID. Mandatory — always included.
    IMAGE SHA The SHA256 digest of the image containing the software.
    IMAGE UUID Unique identifier for the image in Qualys CS.

  9. For an on-demand report, specify the time zone where you want to view the date and time in your report. 

  10. Click Next. Review the report summary and then click Submit to submit the report job.

    In the case of an on-demand report job, it appears in the Reports tab with the Accepted status. Once the report is generated, its status changes to Completed and it is ready to download. Select Download from the Quick Actions menu to view the completed report.

    In the case of a scheduled report job, the schedule appears in the Schedule tab. When a schedule is triggered, a report job is created in the Reports tab. The Report Type column helps you identify the report type, on-demand or scheduled.

See also

Manage Your Reports

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: August, 2026