Fetch All Asset Details

For API version information, refer to the API Version History section.

Non-Versioned

This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.

GET/ioc/asset/all

Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List

Input Parameters	Mandatory/Optional	Format	Description
Authorization	Mandatory	String	Authorization parameter authenticates the Qualys Enterprise TruRisk™ Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken.
filter	Optional	String	Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query. For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created' You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter.
pageNumber	Optional	String	The pageNumber parameter returns the page to be returned. It starts from the value zero
pageSize	Optional	String	The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10.
include_attributes	Optional	String	include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes. For example: include_attributes = _type, _id, processName
exclude_attributes	Optional	String	exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list. For example: exclude_attributes = _type, _id, processName Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded.
sort	Optional	String	The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help. For example:asset.platform: 'Windows'

Sample - Fetch Asset ListSample - Fetch Asset List

API Request

curl -X GET "<qualys_base_url>/ioc/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"

Response

[
  {
    "hostName": "QBAS2",
    "lastReportedTime": "2024-12-09T14:36:08.605+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "0",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
    "platform": "Windows",
    "isAVUpToDate": false,
    "lastLoggedOnUser": "Administrator",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": true,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "Intel(R) 82574L Gigabit Network Connection",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Re-installing",
    "avStatusCategory": "In Progress",
    "tags": [
      {
        "name": "Test-TK",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "TestMadhuri",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Dynamic-test-EDR",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:43.899+0000",
    "avErrorCode": "Re-installing",
    "edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
  },
  {
    "hostName": "indra.centos7.edr.qualys.com",
    "avWorkflow": "UPDATE",
    "lastReportedTime": "2024-12-30T07:45:07.541+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "28",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "CentOS Linux 7.5.1804",
    "isAVUpToDate": false,
    "platform": "Linux",
    "lastLoggedOnUser": "root",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": false,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "ens192",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Update Error",
    "avStatusCategory": "Update Failed",
    "tags": [
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:44.970+0000",
    "avErrorCode": "DOWNLOAD_FAILURE",
    "edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
    "system": {
      "lastBoot": "2024-11-05 10:06:08",
      "timezone": "+05:30",
      "model": "VMware Virtual Platform",
      "manufacturer": "VMware, Inc."
    }
  }
]

Response Field DescriptionsResponse Field Descriptions

Dataset Name	Field Name	Data Type	Description
Asset	hostName	String	The hostname of the asset.
	lastReportedTime	Timestamp	Timestamp of the last reported EDR event (ISO 8601 format).
	edrFunctionalStatus	String	EDR status of the asset. Active: EDR is enabled , and the Last Reported Time is within 24 hours. Inactive: EDR is enabled, but the Last Reported Time exceeds 24 hours. Disabled: EDR is turned off. You can enable EDR from the Qualys Cloud Agent application.
	productUpdateErrorCode	Integer	Anti-malware update error code. Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates.
	downloadPercent	Integer	Download status of AV installation or updates, expressed as a percentage (%).
	operatingSystem	String	The operating system of the asset. E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778
	platform	String	The platform of the asset (Windows or Linux or Mac.)
	isAVUpToDate	Boolean	Indicates whether the anti-malware is updated to latest version (true or false.)
	lastLoggedOnUser	String	Indicates the most recent user who logged in to the endpoint.
	id	String	A unique identifier assigned to the agent installed on the asset.
	isEDREnabled	Boolean	Indicates whether EDR is enabled on the endpoint (true or false.)
	avStatus	Boolean	Indicates if AV is successfully installed on the endpoint (true or false.)
	antimalwareStatus	String	Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.)
	avStatusCategory	String	Displays the category or reason for the above-specified AV status.
	avErrorCode	String	Indicates the error codes associated with AV installation or updates.
	edrActivatedOnDate	Timestamp	The date and time when EDR was activated on the asset.
	avProfile	Object	The anti-malware profile associated with the asset. Dataset: AVProfile
	interfaces	Array of Object	List of interfaces associated with the asset. Dataset: Interfaces
	tags	Array of Object	List of tags associated with the asset. Dataset: Tags
AVProfile	name	String	The name of the AV profile.
	id	String	The unique identifier assigned to the AV profile.
	status	String	The assignment status of the AV profile (e.g . ASSIGNED.)
Interfaces	macAddress	String	The MAC address of the network interface.
	ipAddress	String	The IP address of the network interface.
	interfaceName	String	The name of the network interface.
	gatewayAddress	String	The gateway address of the network interface.
Tags	name	String	The name of the tag.
	uuid	String	The unique identifier for the tag.

V1.0

This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.

GET/ioc/v1/asset/all

Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List

Input Parameters	Mandatory/Optional	Format	Description
Authorization	Mandatory	String	Authorization parameter authenticates the Qualys Enterprise TruRisk™ Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken.
filter	Optional	String	Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query. For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created' You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter.
pageNumber	Optional	String	The pageNumber parameter returns the page to be returned. It starts from the value zero
pageSize	Optional	String	The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10.
include_attributes	Optional	String	include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes. For example: include_attributes = _type, _id, processName
exclude_attributes	Optional	String	exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list. For example: exclude_attributes = _type, _id, processName Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded.
sort	Optional	String	The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help. For example:asset.platform: 'Windows'

Sample - Fetch Asset ListSample - Fetch Asset List

API Request

curl -X GET "<qualys_base_url>/ioc/v1/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"

Response

[
  {
    "hostName": "QBAS2",
    "lastReportedTime": "2024-12-09T14:36:08.605+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "0",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
    "platform": "Windows",
    "isAVUpToDate": false,
    "lastLoggedOnUser": "Administrator",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": true,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "Intel(R) 82574L Gigabit Network Connection",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Re-installing",
    "avStatusCategory": "In Progress",
    "tags": [
      {
        "name": "Test-TK",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "TestMadhuri",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Dynamic-test-EDR",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:43.899+0000",
    "avErrorCode": "Re-installing",
    "edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
  },
  {
    "hostName": "indra.centos7.edr.qualys.com",
    "avWorkflow": "UPDATE",
    "lastReportedTime": "2024-12-30T07:45:07.541+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "28",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "CentOS Linux 7.5.1804",
    "isAVUpToDate": false,
    "platform": "Linux",
    "lastLoggedOnUser": "root",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": false,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "ens192",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Update Error",
    "avStatusCategory": "Update Failed",
    "tags": [
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:44.970+0000",
    "avErrorCode": "DOWNLOAD_FAILURE",
    "edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
    "system": {
      "lastBoot": "2024-11-05 10:06:08",
      "timezone": "+05:30",
      "model": "VMware Virtual Platform",
      "manufacturer": "VMware, Inc."
    }
  }
]

Response Field DescriptionsResponse Field Descriptions

Dataset Name	Field Name	Data Type	Description
Asset	hostName	String	The hostname of the asset.
	lastReportedTime	Timestamp	Timestamp of the last reported EDR event (ISO 8601 format).
	edrFunctionalStatus	String	EDR status of the asset. Active: EDR is enabled , and the Last Reported Time is within 24 hours. Inactive: EDR is enabled, but the Last Reported Time exceeds 24 hours. Disabled: EDR is turned off. You can enable EDR from the Qualys Cloud Agent application.
	productUpdateErrorCode	Integer	Anti-malware update error code. Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates.
	downloadPercent	Integer	Download status of AV installation or updates, expressed as a percentage (%).
	operatingSystem	String	The operating system of the asset. E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778
	platform	String	The platform of the asset (Windows or Linux or Mac.)
	isAVUpToDate	Boolean	Indicates whether the anti-malware is updated to latest version (true or false.)
	lastLoggedOnUser	String	Indicates the most recent user who logged in to the endpoint.
	id	String	A unique identifier assigned to the agent installed on the asset.
	isEDREnabled	Boolean	Indicates whether EDR is enabled on the endpoint (true or false.)
	avStatus	Boolean	Indicates if AV is successfully installed on the endpoint (true or false.)
	antimalwareStatus	String	Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.)
	avStatusCategory	String	Displays the category or reason for the above-specified AV status.
	avErrorCode	String	Indicates the error codes associated with AV installation or updates.
	edrActivatedOnDate	Timestamp	The date and time when EDR was activated on the asset.
	avProfile	Object	The anti-malware profile associated with the asset. Dataset: AVProfile
	interfaces	Array of Object	List of interfaces associated with the asset. Dataset: Interfaces
	tags	Array of Object	List of tags associated with the asset. Dataset: Tags
AVProfile	name	String	The name of the AV profile.
	id	String	The unique identifier assigned to the AV profile.
	status	String	The assignment status of the AV profile (e.g . ASSIGNED.)
Interfaces	macAddress	String	The MAC address of the network interface.
	ipAddress	String	The IP address of the network interface.
	interfaceName	String	The name of the network interface.
	gatewayAddress	String	The gateway address of the network interface.
Tags	name	String	The name of the tag.
	uuid	String	The unique identifier for the tag.

API Version History

The following table depicts the information about the different versions of this API along with the status:

API Version	API Status	Release Date
/ioc/asset/all	Active
/ioc/v1/asset/all	Active	May 2025