Fetch All Asset Details
For API version information, refer to the API Version History section.
Non-Versioned
This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.
Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List
Input Parameters |
Mandatory/Optional |
Format |
Description |
---|---|---|---|
Authorization |
Mandatory |
String |
Authorization parameter authenticates the Qualys Enterprise TruRisk™ Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken. |
filter |
Optional |
String |
Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query. For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created' You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter. |
pageNumber |
Optional |
String |
The pageNumber parameter returns the page to be returned. It starts from the value zero |
pageSize |
Optional |
String |
The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10. |
include_attributes |
Optional |
String |
include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes. For example: include_attributes = _type, _id, processName |
exclude_attributes |
Optional |
String |
exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list. For example: exclude_attributes = _type, _id, processName Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded. |
sort |
Optional |
String |
The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help. For example:asset.platform: 'Windows' |
Sample - Fetch Asset ListSample - Fetch Asset List
API Request
curl -X GET "<qualys_base_url>/ioc/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"
Response
[
{
"hostName": "QBAS2",
"lastReportedTime": "2024-12-09T14:36:08.605+0000",
"edrFunctionalStatus": "Inactive",
"productUpdateErrorCode": "0",
"downloadPercent": 100,
"avProfile": {
"name": "test-12345",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"status": "ASSIGNED"
},
"operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
"platform": "Windows",
"isAVUpToDate": false,
"lastLoggedOnUser": "Administrator",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"isEDREnabled": true,
"interfaces": [
{
"macAddress": "00:X0:XX:0X:00:00",
"ipAddress": "X0.1X.XX1.00",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection",
"gatewayAddress": "XX.XX.X0X.X"
}
],
"avStatus": false,
"antimalwareStatus": "Re-installing",
"avStatusCategory": "In Progress",
"tags": [
{
"name": "Test-TK",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Cloud Agent",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "ProfileAssignTag",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "test45",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "TestMadhuri",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Dynamic-test-EDR",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
}
],
"timeStamp": "2025-02-25T06:21:43.899+0000",
"avErrorCode": "Re-installing",
"edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
},
{
"hostName": "indra.centos7.edr.qualys.com",
"avWorkflow": "UPDATE",
"lastReportedTime": "2024-12-30T07:45:07.541+0000",
"edrFunctionalStatus": "Inactive",
"productUpdateErrorCode": "28",
"downloadPercent": 100,
"avProfile": {
"name": "test-12345",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"status": "ASSIGNED"
},
"operatingSystem": "CentOS Linux 7.5.1804",
"isAVUpToDate": false,
"platform": "Linux",
"lastLoggedOnUser": "root",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"isEDREnabled": false,
"interfaces": [
{
"macAddress": "00:X0:XX:0X:00:00",
"ipAddress": "X0.1X.XX1.00",
"interfaceName": "ens192",
"gatewayAddress": "XX.XX.X0X.X"
}
],
"avStatus": false,
"antimalwareStatus": "Update Error",
"avStatusCategory": "Update Failed",
"tags": [
{
"name": "test45",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "ProfileAssignTag",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Cloud Agent",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
}
],
"timeStamp": "2025-02-25T06:21:44.970+0000",
"avErrorCode": "DOWNLOAD_FAILURE",
"edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
"system": {
"lastBoot": "2024-11-05 10:06:08",
"timezone": "+05:30",
"model": "VMware Virtual Platform",
"manufacturer": "VMware, Inc."
}
}
]
Response Field DescriptionsResponse Field Descriptions
Dataset Name |
Field Name |
Data Type |
Description |
---|---|---|---|
Asset | hostName | String | The hostname of the asset. |
lastReportedTime | Timestamp | Timestamp of the last reported EDR event (ISO 8601 format). | |
edrFunctionalStatus | String |
EDR status of the asset.
|
|
productUpdateErrorCode | Integer |
Anti-malware update error code. Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates. |
|
downloadPercent | Integer | Download status of AV installation or updates, expressed as a percentage (%). | |
operatingSystem | String |
The operating system of the asset. E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778 |
|
platform | String | The platform of the asset (Windows or Linux or Mac.) | |
isAVUpToDate | Boolean | Indicates whether the anti-malware is updated to latest version (true or false.) | |
lastLoggedOnUser | String | Indicates the most recent user who logged in to the endpoint. | |
id | String | A unique identifier assigned to the agent installed on the asset. | |
isEDREnabled | Boolean | Indicates whether EDR is enabled on the endpoint (true or false.) | |
avStatus | Boolean | Indicates if AV is successfully installed on the endpoint (true or false.) | |
antimalwareStatus | String | Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.) | |
avStatusCategory | String | Displays the category or reason for the above-specified AV status. | |
avErrorCode | String | Indicates the error codes associated with AV installation or updates. | |
edrActivatedOnDate | Timestamp | The date and time when EDR was activated on the asset. | |
avProfile | Object |
The anti-malware profile associated with the asset. Dataset: AVProfile |
|
interfaces | Array of Object |
List of interfaces associated with the asset. Dataset: Interfaces |
|
tags | Array of Object |
List of tags associated with the asset. Dataset: Tags |
|
AVProfile | name | String | The name of the AV profile. |
id | String | The unique identifier assigned to the AV profile. | |
status | String | The assignment status of the AV profile (e.g . ASSIGNED.) | |
Interfaces | macAddress | String | The MAC address of the network interface. |
ipAddress | String | The IP address of the network interface. | |
interfaceName | String | The name of the network interface. | |
gatewayAddress | String | The gateway address of the network interface. | |
Tags | name | String | The name of the tag. |
uuid | String | The unique identifier for the tag. |
V1.0
This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.
Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List
Input Parameters |
Mandatory/Optional |
Format |
Description |
---|---|---|---|
Authorization |
Mandatory |
String |
Authorization parameter authenticates the Qualys Enterprise TruRisk™ Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken. |
filter |
Optional |
String |
Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query. For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created' You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter. |
pageNumber |
Optional |
String |
The pageNumber parameter returns the page to be returned. It starts from the value zero |
pageSize |
Optional |
String |
The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10. |
include_attributes |
Optional |
String |
include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes. For example: include_attributes = _type, _id, processName |
exclude_attributes |
Optional |
String |
exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list. For example: exclude_attributes = _type, _id, processName Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded. |
sort |
Optional |
String |
The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help. For example:asset.platform: 'Windows' |
Sample - Fetch Asset ListSample - Fetch Asset List
API Request
curl -X GET "<qualys_base_url>/ioc/v1/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"
Response
[
{
"hostName": "QBAS2",
"lastReportedTime": "2024-12-09T14:36:08.605+0000",
"edrFunctionalStatus": "Inactive",
"productUpdateErrorCode": "0",
"downloadPercent": 100,
"avProfile": {
"name": "test-12345",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"status": "ASSIGNED"
},
"operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
"platform": "Windows",
"isAVUpToDate": false,
"lastLoggedOnUser": "Administrator",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"isEDREnabled": true,
"interfaces": [
{
"macAddress": "00:X0:XX:0X:00:00",
"ipAddress": "X0.1X.XX1.00",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection",
"gatewayAddress": "XX.XX.X0X.X"
}
],
"avStatus": false,
"antimalwareStatus": "Re-installing",
"avStatusCategory": "In Progress",
"tags": [
{
"name": "Test-TK",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Cloud Agent",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "ProfileAssignTag",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "test45",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "TestMadhuri",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Dynamic-test-EDR",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
}
],
"timeStamp": "2025-02-25T06:21:43.899+0000",
"avErrorCode": "Re-installing",
"edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
},
{
"hostName": "indra.centos7.edr.qualys.com",
"avWorkflow": "UPDATE",
"lastReportedTime": "2024-12-30T07:45:07.541+0000",
"edrFunctionalStatus": "Inactive",
"productUpdateErrorCode": "28",
"downloadPercent": 100,
"avProfile": {
"name": "test-12345",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"status": "ASSIGNED"
},
"operatingSystem": "CentOS Linux 7.5.1804",
"isAVUpToDate": false,
"platform": "Linux",
"lastLoggedOnUser": "root",
"id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
"isEDREnabled": false,
"interfaces": [
{
"macAddress": "00:X0:XX:0X:00:00",
"ipAddress": "X0.1X.XX1.00",
"interfaceName": "ens192",
"gatewayAddress": "XX.XX.X0X.X"
}
],
"avStatus": false,
"antimalwareStatus": "Update Error",
"avStatusCategory": "Update Failed",
"tags": [
{
"name": "test45",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "ProfileAssignTag",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
},
{
"name": "Cloud Agent",
"uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
}
],
"timeStamp": "2025-02-25T06:21:44.970+0000",
"avErrorCode": "DOWNLOAD_FAILURE",
"edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
"system": {
"lastBoot": "2024-11-05 10:06:08",
"timezone": "+05:30",
"model": "VMware Virtual Platform",
"manufacturer": "VMware, Inc."
}
}
]
Response Field DescriptionsResponse Field Descriptions
Dataset Name |
Field Name |
Data Type |
Description |
---|---|---|---|
Asset | hostName | String | The hostname of the asset. |
lastReportedTime | Timestamp | Timestamp of the last reported EDR event (ISO 8601 format). | |
edrFunctionalStatus | String |
EDR status of the asset.
|
|
productUpdateErrorCode | Integer |
Anti-malware update error code. Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates. |
|
downloadPercent | Integer | Download status of AV installation or updates, expressed as a percentage (%). | |
operatingSystem | String |
The operating system of the asset. E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778 |
|
platform | String | The platform of the asset (Windows or Linux or Mac.) | |
isAVUpToDate | Boolean | Indicates whether the anti-malware is updated to latest version (true or false.) | |
lastLoggedOnUser | String | Indicates the most recent user who logged in to the endpoint. | |
id | String | A unique identifier assigned to the agent installed on the asset. | |
isEDREnabled | Boolean | Indicates whether EDR is enabled on the endpoint (true or false.) | |
avStatus | Boolean | Indicates if AV is successfully installed on the endpoint (true or false.) | |
antimalwareStatus | String | Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.) | |
avStatusCategory | String | Displays the category or reason for the above-specified AV status. | |
avErrorCode | String | Indicates the error codes associated with AV installation or updates. | |
edrActivatedOnDate | Timestamp | The date and time when EDR was activated on the asset. | |
avProfile | Object |
The anti-malware profile associated with the asset. Dataset: AVProfile |
|
interfaces | Array of Object |
List of interfaces associated with the asset. Dataset: Interfaces |
|
tags | Array of Object |
List of tags associated with the asset. Dataset: Tags |
|
AVProfile | name | String | The name of the AV profile. |
id | String | The unique identifier assigned to the AV profile. | |
status | String | The assignment status of the AV profile (e.g . ASSIGNED.) | |
Interfaces | macAddress | String | The MAC address of the network interface. |
ipAddress | String | The IP address of the network interface. | |
interfaceName | String | The name of the network interface. | |
gatewayAddress | String | The gateway address of the network interface. | |
Tags | name | String | The name of the tag. |
uuid | String | The unique identifier for the tag. |
API Version History
The following table depicts the information about the different versions of this API along with the status:
API Version | API Status | Release Date |
/ioc/asset/all | Active | |
/ioc/v1/asset/all | Active | May 2025 |