Manage Sensor Profiles

You can create sensor profiles of the following types: General, CICD, Registry, Runtime, Cluster, and Serverless Fargate. Select the profile type that matches your deployment and follow the steps for that type.

General Sensor Profile

Follow the steps below to create a General Sensor profile (6 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select General Sensor from the dropdown.
    Enable vulnerability propagation Select this option to enable vulnerability propagation for sensors in this profile.

  2. Assign Sensors
    Assign sensors and tags to the profile and click Next.

    Section Description
    Assign Sensors Click + to assign one or more sensors for scanning.
    Assign Tags Click + to assign tags to the sensor profile. Any sensor associated with the selected tags will be included in this profile.
    • A profile can have a maximum of 10 tags.
    • Use the prefix qcs_sensor_profile_<tag name> when creating special tags for General Sensor Profiles.

  3. Log Settings
    Configure log settings for the sensors in this profile. These settings overwrite the log settings defined for individual sensors. Click Next when done.

    Field Description
    Log Level Select the log level to determine the type of sensor data to log. Default: Information.
    Log File Purge Count Enter the maximum number of log files to archive. Valid range: 1–10. Default: 5.
    Log File Size Enter the maximum file size for each log file (in MB). Valid range: 1–50 MB. Default: 10 MB.

  4. Sensor Inactive Windows
    Configure windows of time when sensors in this profile will be dormant. This is useful to avoid network communication during peak business hours. Click Next when done.

    Sensor Inactive Windows requires sensor version 1.21 or later.

    Click + Add Sensor Inactive Window to add a window. For each window, pick a day of the week and select a start time and end time, or select All Day. Start and end times are based on the sensor's UTC time zone.

  5. Vulnerability Management
    Configure how sensors in this profile collect data for vulnerability management and policy compliance scans. Click Next when done.

    Field Description
    Configure Image Scans Select whether sensors perform static scanning as a fallback to dynamic scanning for images without a shell. This setting applies when a new image is pulled or the manifest is updated, and applies to vulnerability scans only.
    • Dynamic Scan: Perform dynamic scanning.
    • Dynamic with Static Fallback: Perform static scanning as a fallback when dynamic scanning is not possible.
    • Static Scan: Perform only static scanning.
    Configure SCA Vulnerabilities Select whether to enable or disable SCA (Software Composition Analysis) vulnerabilities for sensors in this profile.
    • Enable: Enable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Disable: Disable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Command Line: Uses `--perform-sca-scan` command-line flag to either enable or disable SCA

    Applies to Sensors v1.44.0 and later. Older sensor versions continue to use the command-line SCA parameter.
    Image Exclusion Create an image exclusion list using regular expressions. Images matching the exclusion list are not scanned. You can create a maximum of 100 regular expressions.

  6. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

CICD Sensor Profile

Follow the steps below to create a CICD Sensor profile (6 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select CICD Sensor from the dropdown.

  2. Assign Sensors
    Assign sensors and tags to the profile and click Next.

    Section Description
    Assign Sensors Click + to assign one or more sensors for scanning.
    Assign Tags Click + to assign tags to the sensor profile. Any sensor associated with the selected tags will be included in this profile.
    • A profile can have a maximum of 10 tags.
    • Use the prefix qcs_sensor_profile_<tag name> when creating special tags for CICD Sensor Profiles.

  3. Log Settings
    Configure log settings for the sensors in this profile. These settings overwrite the log settings defined for individual sensors. Click Next when done.

    Field Description
    Log Level Select the log level to determine the type of sensor data to log. Default: Information.
    Log File Purge Count Enter the maximum number of log files to archive. Valid range: 1–10. Default: 5.
    Log File Size Enter the maximum file size for each log file (in MB). Valid range: 1–50 MB. Default: 10 MB.

  4. Sensor Inactive Windows
    Configure windows of time when sensors in this profile will be dormant. This is useful to avoid network communication during peak business hours. Click Next when done.

    Sensor Inactive Windows requires sensor version 1.21 or later.

    Click + Add Sensor Inactive Window to add a window. For each window, pick a day of the week and select a start time and end time, or select All Day. Start and end times are based on the sensor's UTC time zone.

  5. Vulnerability Management
    Configure how sensors in this profile collect data for vulnerability management and policy compliance scans. Click Next when done.

    Field Description
    Configure Image Scans Select whether sensors perform static scanning as a fallback to dynamic scanning for images without a shell. This setting applies when a new image is pulled or the manifest is updated, and applies to vulnerability scans only.
    • Dynamic Scan: Perform dynamic scanning.
    • Dynamic Scan with Static as Fallback: Perform static scanning as a fallback when dynamic scanning is not possible.
    • Static Scan: Perform only static scanning.
    Configure SCA Vulnerabilities Select whether to enable or disable SCA (Software Composition Analysis) vulnerabilities for sensors in this profile.
    • Enable: Enable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Disable: Disable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Command Line: Uses `--perform-sca-scan` command-line flag to either enable or disable SCA.

    Applies to Sensors v1.44.0 and later. Older sensor versions continue to use the command-line SCA parameter.

  6. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

Registry Sensor Profile

Follow the steps below to create a Registry Sensor profile (7 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select Registry Sensor from the dropdown.

  2. Assign Registries
    Assign the registries to be scanned by the sensors in this profile. Click + to add registries and click Next.

    The list shows the following details for each assigned registry.

    Column Description
    Registry Name The name of the registry as configured in your account.
    Registry The URL or endpoint of the registry.
    Type The type of registry (for example, V2_PRIVATE).
    Images The number of images in the registry.

    To remove a registry from the list, click the x next to its row, or select one or more registries and click Remove Selected.

  3. Assign Sensors
    Assign sensors and tags to the profile and click Next.

    Section Description
    Assign Sensors Click + to assign one or more sensors for scanning the registries in this profile.
    Assign Tags Click + to assign tags to the sensor profile. Any sensor associated with the selected tags will be included in this profile.
    • A profile can have a maximum of 10 tags.
    • Use the prefix qcs_sensor_profile_<tag name> when creating special tags for Registry Sensor Profiles.

  4. Log Settings
    Configure log settings for the sensors in this profile. These settings overwrite the log settings defined for individual sensors. Click Next when done.

    Field Description
    Log Level Select the log level to determine the type of sensor data to log. Default: Information.
    Log File Purge Count Enter the maximum number of log files to archive. Valid range: 1–10. Default: 5.
    Log File Size Enter the maximum file size for each log file (in MB). Valid range: 1–50 MB. Default: 10 MB.

  5. Sensor Inactive Windows
    Configure windows of time when sensors in this profile will be dormant. This is useful to avoid network communication during peak business hours. Click Next when done.

    Sensor Inactive Windows requires sensor version 1.23 or later for Registry Sensor Profiles.

    Click + Add Sensor Inactive Window to add a window. For each window, pick a day of the week and select a start time and end time, or select All Day. Start and end times are based on the sensor's UTC time zone.

  6. Vulnerability Management
    Configure how sensors in this profile collect data for vulnerability management and policy compliance scans. Click Next when done.

    Field Description
    Configure Image Scans Select whether sensors perform static scanning as a fallback to dynamic scanning for images without a shell. This setting applies when a new image is pulled or the manifest is updated, and applies to vulnerability scans only.
    • Dynamic Scan: Perform dynamic scanning.
    • Dynamic with Static Fallback: Perform static scanning as a fallback when dynamic scanning is not possible.
    • Static Scan: Perform only static scanning.
    Configure SCA Vulnerabilities Select whether to enable or disable SCA (Software Composition Analysis) vulnerabilities for sensors in this profile.
    • Enable: Enable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Disable: Disable SCA vulnerability detection. Ignores command-line flag - `--perform-sca-scan`.
    • Command Line: Uses `--perform-sca-scan` command-line flag to either enable or disable SCA.

    Applies to Sensors v1.44.0 and later. Older sensor versions continue to use the command-line SCA parameter.

  7. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

Runtime Sensor Profile

Follow the steps below to create a Runtime Sensor profile (5 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select Runtime Sensor from the dropdown.

  2. Assign Sensors
    Assign sensors, tags, and sensor event tracking to the profile and click Next.

    Section Description
    Assign Sensors Click + to assign one or more sensors for scanning.
    Assign Tags Click + to assign tags to the sensor profile. Any sensor associated with the selected tags will be included in this profile.
    • A profile can have a maximum of 10 tags.
    • Use the prefix runtime_sensor_profile_<tag name> when creating special tags for Runtime Sensor Profiles.
    Sensor Events Settings Select whether the Runtime Sensor tracks events occurring in your container.
    • Enable: The sensor tracks and reports container events.
    • Disable: Container event tracking is turned off.

  3. Log Settings
    Configure log settings for the sensors in this profile. These settings overwrite the log settings defined for individual sensors. Click Next when done.

    Field Description
    Log Level Select the log level to determine the type of sensor data to log. Default: Information.
    • Information: Logs informational messages and above.
    • Warning: Logs warnings and above.
    • Error: Logs errors and above.
    • Fatal: Logs only fatal errors.
    • Debug: Logs all messages including debug-level detail.
    Log File Purge Count Enter the maximum number of log files to archive. Valid range: 1–10. Default: 5.
    Log File Size Enter the maximum file size for each log file (in MB). Valid range: 1–50 MB. Default: 10 MB.

  4. Process Exclusion
    Add processes to exclude from Runtime Sensor event scanning and click Next.

    In the Processes field, enter the processes to exclude. You can enter up to 50 entries. Each entry can be an absolute path, a binary name, or a regular-expression pattern.

    Examples: /usr/bin/cat, cat, /usr/*/cat, .*/cat, ^abc$, /dev/fd/|/run/shm/

    Entry rules:

    • Allowed characters: alphanumeric characters and / . _ - * ? + | ^ $ ( ) [ ]
    • Each entry must contain at least one alphanumeric character.
    • Spaces and other characters are not allowed.
    • // (double slash) and a leading /* are not allowed.
    • A trailing / is not allowed unless the entry uses alternation |.

  5. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

Cluster Sensor Profile

Follow the steps below to create a Cluster Sensor profile (4 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select Cluster Sensor from the dropdown.
    Enable vulnerability propagation Select this option to enable vulnerability propagation for sensors in this profile.

  2. Assign Sensors
    Assign sensors and tags to the profile and click Next.

    Section Description
    Assign Sensors Click + to assign one or more sensors for scanning.
    Assign Tags Click + to assign tags to the sensor profile. Any sensor associated with the selected tags will be included in this profile.
    • A profile can have a maximum of 10 tags.
    • Use the prefix cluster_sensor_profile_<tag name> when creating special tags for Cluster Sensor Profiles.

  3. Log Settings
    Configure log settings for the sensors in this profile. These settings overwrite the log settings defined for individual sensors. Click Next when done.

    Field Description
    Log Level Select the log level to determine the type of sensor data to log. Default: Information.
    Log File Purge Count Enter the maximum number of log files to archive. Valid range: 1–10. Default: 5.
    Log File Size Enter the maximum file size for each log file (in MB). Valid range: 1–50 MB. Default: 10 MB.

  4. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

Serverless Fargate Profile

Follow the steps below to create a Serverless Fargate profile (3 steps).

  1. Basic Details
    Enter the following details and click Next.

    Field Description
    Profile Name (required) Enter a unique name for the sensor profile. Maximum 64 characters.
    Description Enter an optional description for the profile. Maximum 255 characters.
    Profile Type (required) Select Serverless Fargate from the dropdown.

  2. Vulnerability Propagation Configuration
    Configure fargate vulnerability propagation and click Next.

    Field Description
    Select Configuration Choose how vulnerability propagation is applied across clusters.
    • Enable Vulnerability Propagation For All Clusters: Enables propagation for all clusters (default).
    • Disable Vulnerability Propagation For All Clusters: Disables propagation for all clusters.
    Exclude Clusters (optional) Enter cluster names to exclude from vulnerability propagation. You can add up to 60 cluster names.

    Cluster name rules:

    • Enter the exact cluster name. After each name, type a comma (,) or press Enter to add it.
    • Only lowercase letters and numbers are allowed.
    • Special characters are not allowed except hyphen (“-”).
    • Maximum length per cluster name: 60 characters.
    • Example: dev-cluster-01

  3. Review and Confirm
    Review all settings for the profile. Click the edit icon next to any section to make changes. Click Submit to create the profile.

Creating a Sensor Profile Tag

Tags are useful to categorize sensor profiles. Follow the steps mentioned below to create a Sensor Profile tag.

  1. Follow the Step 1 to Step 3 mentioned in Creating a Sensor Profile.
  2. In Select Tags window, click Create New Tag.
  3. Enter details of the tag.
    Tag Property Description
    Name Nam of the tag.
    See 'Tag name guidelines' given below.*
    Description Provide description of the tag.
    Asset Criticality Score This score represents the criticality of the asset to your business infrastructure.
    Valid values - '1' to '5'.

    To know more, refer to Asset Criticality Score.
    Tag Color Specify a color to a tag for ease of identification.
    Select Parent Tag Choose an existing tag to act as a parent tag to your new tag. Ignore this option if you want the new tag to act as a parent tag.
    Tag Type Choose type of the tag.
    Valid values - Static or Dynamic


    *Tag name guidelines:
    - The total of allowed tags is limited to 10 (logical constraint)
    - You need to use Kubernetes label specifications for naming a Tag -
             - It must be 63 characters or less or it can be empty.
             - Unless empty, it must begin and end with an alphanumeric character ([a-z, 0-9, A-Z]),
             - Could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
             - No spaces are allowed.

  4. If you have chosen Dynamic tag type, select the rule template.
  5. Click Create.

The newly created tag is listed under All Tags window.

Once a tag is created, you can assign it to a sensor profile and it wil be displayed in the List page. You can remove a tag using Edit option available with each sensor profile.

What are Special Tags?

Special tags automatically assign sensor profiles to a sensor. A sensor launched with a special tag gets assigned the sensor profiles with a similar special tag. It is done by mentioning a special tag during a sensor launch using the Command Line Interface. The sensor profiles having such special tags are assigned to the newly launched sensor.

Sensor                                                 Special Tag Usage
Installsensor.sh Docker Run or Kubernetes
General Sensor (qcs-sensor) qcs_sensor_profile_<tag name>
 		 --tag-sensor-profile=<tag name>
Runtime Sensor runtime_sensor_profile_<tage name>
 		 --runtime-sensor-profile= <tag name>
Cluster Sensor cluster_sensor_profile_<tag name>

  		--cluster-sensor-profile= <tag name>

You can view the special tags associated with Sensors on the Qualys Cloud Platform under Container Security > CONFIGURATIONS > Sensors.

Editing, or Deleting a Sensor Profile

  1. Select the sensor profile that you want to edit or delete from Configurations > Sensor Profiles.

  2. Select an appropriate action from the Quick Actions menu.

    Option Description
    View Shows details of the sensor profile.
    Edit Let's you edit the sensor profile. Use this option to edit sensor profile tags.
    Delete Deletes the sensor profile.

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: September, 2026