Container Security Release 1.45

August 25, 2026

Introduced AWS Fargate Container QLP: Workload-Level Vulnerability Tracking

Container Security now tracks and manages vulnerabilities at the individual container instance level for AWS Fargate workloads using Qualys Locator Path (QLP). Vulnerability findings from image scans propagate to specific Fargate container instances, giving you a workload-level risk view that maps directly to what is running in your environment.

A new Container QLP tab is available under Qualys Enterprise TruRisk™ Platform > Container Security > Assets. Each QLP record is identified by a unique combination of Workload ID, Image Digest, and Container Name. This tab also shows more details about a QLP such as, First Seen, Last Updated, Cloaud Tags, and so on.

You can filter and group QLP records using QQL tokens and Group By, and access the data through the API.

The QLP path format is: <cloudProvider://source/region/accountId/clusterName/workloadId/taskDef/containerName/imageDigest/arch>

The following image shows the Container QLP tab in the Assets page. To know more about Container QLP details, refer to CS Online Help.

Key Benefits

Workload-level risk view that maps vulnerability findings directly to running Fargate container instances
Unique identification of each container workload by image and architecture combination, eliminating ambiguity across tasks
Automatic inventory upload for existing ECS Fargate tasks and services when the CloudFormation stack is deployed
QQL tokens, Group By, and API support for flexible querying and integration

New Cloud Operator & Updated CFT

A new Cloud Operator version and updated CloudFormation templates (CFTs) are released alongside this feature. The updated CFT includes additional parameters to enable Fargate inventory collection through the Service Account Scanning stack. You can also enable or disable Lambda scanning from the CFT.

Introducing Azure Function Scanning: Vulnerability and SCA Detection for Serverless Functions

Qualys now provides the ability to scan Microsoft Azure functions for vulnerabilities and SCA Findings. This extends serverless scanning coverage from AWS Lambda to Azure, giving you a unified security view across cloud providers from a single platform.

Both Azure Function deployment types are supported.

Image-based Azure Functions
Deployment (Zip) Azure Functions

Scan results — including vulnerability findings, TruRisk™ Score, and installed software — are available for all OS and non-OS packages detected in the scanned functions. You can download the results from the Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Serverless Functions.

The following image shows Azure Functions scan results in the Serverless Functions page.

Key Benefits

Unified vulnerability visibility across AWS Lambda and Azure Functions from a single platform
Real-time detection of vulnerabilities in both image-based and deployment-based Azure Functions
End-to-end scan processing with full vulnerability, TruRisk, and software inventory reporting
Downloadable scan results for both OS and non-OS packages

Prerequisites

To scan Azure Functions, you need the following Azure credentials.

Subscription ID
Tenant ID
Client ID
Client Secret

Enhanced Lambda Function Scanning: Image Association and Scan Data Retention

AWS Lambda function scans now include image association and historical data retention. Lambda functions scanned by Qualys are associated with their container images, and scan data is retained over time for improved traceability, reporting, and lifecycle visibility.

Serverless Functions Data Retention Setting

A new Serverless Functions section is now available under Configurations > General > Data Retention Settings. You can configure how long serverless function records are retained. The retention period is configurable between 7 and 30 days. Serverless functions that are Not Updated within the configured period are automatically deleted.

Introduced Active Package Detection: Runtime Package-in-Use Visibility

You can now identify which installed packages are actively loaded in memory across running containers. The vulnerability page displays package-in-use context, helping you prioritize remediation for packages that are actively running and therefore present a higher exploitation risk than packages that are installed but not loaded.

You can use vulnerabilities.vulnerable.packages.inuse: QQL to sort the Vulnerabilities.

How to Enable

Runtime Sensor (CRS): This is the recommended approach by Qualys. It is enabled by default starting with CRS version 1.8.0. To disable, use --disable-pkg-in-use.
General Sensor: add the --enable-pkg-in-use argument when deploying the sensor. Applicable across all supported runtimes: Docker, Podman, containerd, and CRI-O.

Package-in-use data uploads every 6 hours when a change is detected from the previous upload.

Key Benefits

More meaningful vulnerability prioritization by distinguishing packages actively loaded in memory from those that are installed but not running
Reduces false urgency from vulnerabilities in packages that cannot be exploited in their current idle state
Real-time runtime visibility into actual software usage across containers, not just static inventory
Supported across all major container runtimes: Docker, Podman, containerd, and CRI-O

Extended JAR SCA in Offline Mode: JAVADB Resolution Without Network Access

We have enhanced JAR detection for offline static scans. Previously, the Java package database required for scanning Java packages was downloaded from an external, unauthenticated public source each time a scan required it. Scans running in offline or network-restricted environments could not download this database, resulting in reduced Java vulnerability coverage.

With this release, the Java package database is hosted by Qualys and delivered through the same channel as your other scan content. This improves scan coverage and accuracy for Java packages in offline-scan mode and removes the need to configure a separate proxy allowance for an external Java database URL.

Use canonical Java packages published by the original package maintainers instead of third-party republished forks. Using the original packages helps ensure accurate vulnerability detection and reduces the risk of false positives or false negatives caused by incorrect package identification.

Introduced Network Events Monitoring: Bi-Directional Traffic Visibility for Running Containers

You can now monitor inbound and outbound network activity for running containers from Qualys Enterprise TruRisk™ Platform > Container Security > Events > Runtime. A new Network Events tab displays bi-directional network traffic captured by the Container Runtime eBPF Sensor, extending runtime visibility alongside existing Process and DNS Events.

The Network Events tab organizes events into two categories.

Egress - outbound network traffic initiated by containers
Ingress - inbound network traffic received by containers

You can use QQL to filter and search network events for faster investigation.

The following image shows the Network Events tab under Runtime Events.

Key Benefits

Expanded runtime coverage with network activity visibility alongside process and DNS events
Bi-directional monitoring with separate Egress and Ingress categorization for clearer traffic analysis
Faster threat detection and investigation using QQL-based filtering
Clearer understanding of container communication patterns at runtime

Introduced Subscription-Level OAuth for QScanner: Centralized Token Authentication

You can now generate a subscription-level Client ID and Client Secret to authenticate QScanner, removing the dependency on individual user accounts. Previously, QScanner authentication required a user-level token tied to a specific account. Subscription-level tokens allow centralized credential management at the subscription level.

- The Subscription Token is highly sensitive and must be treated as a secret credential.
- Subscription-level tokens are supported for QScanner only.
- Container Security APIs cannot be accessed using a subscription-level token.

Required Permissions

To use a subscription-level token with QScanner, assign the following permissions when creating the client.

Policy Evaluation
QScanner Scan CICD
CS Access
CS API Access
CS UI Access

The following image shows the subscription-level OAuth token configuration in Auth ID Client Management.

Key Benefits

Eliminates dependency on individual user accounts, making QScanner authentication resilient to user account changes or departures
Centralized credential management at the subscription level simplifies token lifecycle administration
Supports least-privilege access by scoping permissions specifically to QScanner operations
Reduces CI/CD pipeline maintenance overhead by decoupling pipeline credentials from personal accounts

Enhancements in Vulnerability and Compliance Reports: New Attributes and Renamed CSV Columns

Container Security report templates now include additional attributes and clearer CSV column names, giving compliance teams richer context during audits and reducing ambiguity in automated data exports. A new Published Date field is added to vulnerability report templates to surface when each QID was first publicly disclosed, and the KSPM compliance report now includes two new attributes - CIS Recommendation and Rationale - for direct alignment with benchmark standards. Two existing CSV column names are also renamed to more precisely describe their content.

Published Date for QID in Vulnerability Reports

A new Published Date attribute is now available in the following report templates, showing when each QID was first published to the Qualys KnowledgeBase. This helps you prioritize older vulnerabilities that have been publicly known for longer and may carry a greater risk of exploitation.

Image Vulnerability Report
Container Vulnerability Report
Vulnerability Report

The following image shows the Published Date attribute in the Image Vulnerability report template configuration.

Enhanced KSPM Report: New Attributes and Renamed CSV Columns

Two new attributes are added to the Compliance (KSPM) Report Template, and two existing CSV column names are updated to improve clarity.

New Report Attributes

CIS Recommendation
Rationale

Renamed CSV Columns

Previous Column Name	New Column Name
REMEDIATION PATH	REMEDIATION PATH (FIX PATHS)
EVIDENCE	EVIDENCE (FAILED PATHS)

If you have automation or scripts that reference these CSV column names, update them to use the new column names before running reports with this release.

Key Benefits

CIS benchmark references now appear directly in reports, making it easier to align findings with industry standards during audits
Rationale column helps teams understand why each control matters, reducing back-and-forth during compliance reviews
Renamed CSV columns improve clarity for compliance teams processing exported data in spreadsheets or SIEM tools

Enhancements in KSPM Controls: Ability to Filter Controls based on Policy Name

A new Controls reference page is now available under Container Security > Posture, alongside the existing Kubernetes Posture page. It lists all Control IDs (CIDs) supported by KSPM, grouped by policy name, giving you a single consolidated view of which controls each policy covers - without opening individual policies one by one.

The CID reference page is a read-only reference. No policy evaluation results are displayed on this page.

The following image shows the newly introduced Controls page (CID reference page).

Key Benefits

Single consolidated view of all supported CIDs and their policy groupings, eliminating the need to navigate individual policies
Faster policy design by understanding which CIDs are available and how they map across policies before configuring evaluations
Programmatic access to control data via new APIs enables integration with external GRC tools and custom reporting workflows

Vulnerability Count Filter: Faster Risk Prioritization in Images and Containers

You can now sort the Images and Containers lists by total vulnerability count. Click the Vulnerability column header on either asset tab to sort assets by vulnerability count, making it faster to identify the highest-risk assets in your environment.

The following images show the Vulnerability column sort on the Images and Containers pages.

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Images

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Containers

Key Benefits

Instantly surfaces the highest-risk images and containers without manual filtering or data export
Faster remediation prioritization by ranking assets directly in the Qualys Enterprise TruRisk™ Platform by vulnerability exposure
Consistent sorting experience across both the Images and Containers tabs

Introduced On-Demand Repository Refresh: Instant Repository Discovery for Registries

You can now refresh the list of repositories for any configured registry on demand. Triggering a refresh fetches the current repository list from the registry source and immediately updates the records in Container Security. Previously, repository discovery depended on scheduled refresh cycles, making it difficult to onboard newly created repositories without waiting.

This is particularly useful for large registries such as JFrog Artifactory and Amazon ECR, where repositories are created frequently, and you need to discover them before configuring a scan job.

- This feature is available only with CS Sensor 1.45 or above version.
- The CS Sensor 1.45 or above that are only in the Running state are considered for this job.

The following images show the Refresh Repositories button on the registry configuration page.

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Registries > Edit registry

After you refresh a repository, the Schedules page displays all its subsequent scheduled jobs.

Key Benefits

Eliminates wait time associated with scheduled discovery cycles when new repositories are added to a registry
Enables immediate scan job configuration for newly created repositories without waiting for the next scheduled sync
Simplifies repository onboarding for large registries such as JFrog Artifactory and Amazon ECR where repositories are created frequently

Extended JFrog Artifactory Scanning: Support for Subdomain-Based Registry URLs

You can now scan JFrog Artifactory registries that use subdomain-based URLs. A new Subdomain field is available while creating a Jfrog Artifactory Private registry.

The following image shows the Subdomain field in the JFrog registry configuration.

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Registries > Create New

Key Benefits

Removes a configuration blocker for customers using subdomain-based JFrog Artifactory deployments
No workarounds or proxy configuration required - the subdomain is entered directly in the registry setup UI
Consistent registry configuration experience across all JFrog Artifactory deployment models

Enhanced Regex Process Ignore List: Flexible Pattern Matching in Runtime Sensor Profiles

You can now define regular expressions (regex) in the QUALYS_IGNORE_PROCESS_LIST configuration for CRS Runtime Sensor profiles. Previously, only exact process names were supported. Regex patterns let you create flexible ignore rules that match families of process names, reducing the maintenance overhead of managing long explicit lists.

Key Benefits

Flexible process filtering — match families of process names with a single regex pattern instead of multiple exact entries
Reduced maintenance overhead as process names change or new variants are introduced over time
Cleaner, more expressive sensor profiles with shorter ignore lists

Security Insights & Attack Paths on Container Details

An Insights tab is now available in the container details page, surfacing security insights directly within the context of a specific container. You no longer need to navigate to the Insights page separately to view risk intelligence for a container you are already inspecting.

The following image shows the Insights tab in the container details page.

???

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Containers > Container Details > Insights

Key Benefits

Reduces context-switching by bringing security insights directly into the container details view
Faster investigation — risk intelligence is available inline without navigating away from the container being inspected
Unified view of container vulnerability, software, and security insight data from a single details page

Introduced Audit and Enforce Modes: Configurable Policy Behavior for CI/CD Pipelines

Each CI/CD and Admission Controller policy can now be set to Audit or Enforce (Block) mode independently. Previously, all policies operated in Block mode — evaluation failures always blocked the pipeline. The configurable behavior modes let you roll out new policies in Audit mode first, assess their impact, and switch to enforcement when ready.

Audit - evaluation failures are reported but do not block the pipeline. Use this mode to assess policy impact before enforcement.
Enforce (Block) - evaluation failures block the pipeline. Use this mode when the policy is ready to act as a compliance gate.

The behavior mode can be configured in the Qualys Enterprise TruRisk™ Platform for new policies.

Policies created before this release default to Enforce (Block) to preserve the previous behavior.

The following image shows the behavior mode selector in the Image Assessment policy configuration. Similar Policy Behavior is introduced in the Admission Controller policy.

Qualys Enterprise TruRisk™ Platform > Container Security > Configurations > Image Assessment / Admission Controller > Policy Basic Details

Key Benefits

Safe policy rollout path - test new policies in Audit mode to assess their impact before enforcing them as compliance gates
Reduces pipeline disruption risk when introducing new policies across development teams
Configurable per policy for fine-grained control over which policies are enforced and which are observed
Backward compatible - policies created before this release default to Enforce (Block) to preserve existing behavior

Enhanced Cloud Metadata Collection: Richer Host Context from AWS, Azure, and GCP

With the help of General Sensor, Qualys Container Security now collects richer cloud provider metadata from AWS, Azure, and GCP hosts. This release adds support for multiple IP addresses per host and cloud-level resource tags, replacing the previous single-IP model and providing the additional fields needed to correlate container workloads with their underlying cloud infrastructure. You can view these details in the Sensor Details page.

What's New by Cloud Provider

Cloud Provider	New Metadata Fields
AWS EC2	local-hostname, public-hostname, vpc-id, subnet-id, availability-zone, region, accountId, security-groups, security-group-ids, tags (key/value pairs), multiple local-ipv4, local-ipv6, public-ipv4, public-ipv6 addresses
Azure VM	vmId, name, resource-id, physical-zone, region, subnet-address, tags (key/value pairs), multiple private-ipAddress, public-ipAddress, private-ipv6Address values
GCP Compute	instance-id, name, hostname, vpc-network, dns-servers, gateway, subnetMask, region, project-id, accountId, multiple private-ipAddress, public-ipAddress values

All new metadata fields are available in the sensor details API response under the cloudProvider block.

For AWS EC2 instance tags to appear in the metadata, instance metadata tag access must be enabled on the EC2 instance. IMDSv2 is required for AWS metadata collection.

Key Benefits

Richer cloud context makes it easier to correlate container workloads with their underlying cloud infrastructure across AWS, Azure, and GCP
Multi-IP support accurately reflects real-world multi-homed and dual-stack host configurations
Cloud resource tags enable label-based filtering and grouping of container assets in the platform
Standardized metadata field names across all three cloud providers simplify cross-cloud reporting and integrations

Introduced Unpatchable QIDs Excluded: Cleaner Vulnerability Results by Default

Unpatchable QIDs are now excluded from vulnerability results by default. A self-serve opt-in option is available if you need to include unpatchable vulnerabilities in your results. This change reduces noise in vulnerability reports and lets you focus on actionable findings. You retain full access to unpatchable vulnerability data through the opt-in.

Key Benefits

Cleaner vulnerability results focused on actionable, patchable findings by default
Reduced noise in dashboards and reports, making it easier to prioritize remediation effort
Self-serve opt-in preserves full access to unpatchable vulnerability data for teams that need complete coverage

For Portal Release Notes: This feature requires portal version 3.24.1.0 or later.

Last updated: August, 2026