Fetch All Asset Details 

For API version information, refer to the API Version History section.

Non-Versioned | V1.0

Non-Versioned

This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.

GET/ioc/asset/all

Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List

Input Parameters

Mandatory/Optional

Format

Description

Authorization

Mandatory

String

Authorization parameter authenticates the Qualys Enterprise TruRisk™  Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken.

filter

Optional

String

Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query.

For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created'

You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter. 

pageNumber

Optional

String

The pageNumber parameter returns the page to be returned. It starts from the value zero

pageSize

Optional

String

The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10.

include_attributes

Optional

String

include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes.

For example: include_attributes = _type, _id, processName

exclude_attributes

Optional

String

exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list.

For example: exclude_attributes = _type, _id, processName

Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded.

sort

Optional

String

The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help.

For example:asset.platform: 'Windows'

Sample - Fetch Asset ListSample - Fetch Asset List

API Request

curl -X GET "<qualys_base_url>/ioc/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"

Response

[
  {
    "hostName": "QBAS2",
    "lastReportedTime": "2024-12-09T14:36:08.605+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "0",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
    "platform": "Windows",
    "isAVUpToDate": false,
    "lastLoggedOnUser": "Administrator",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": true,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "Intel(R) 82574L Gigabit Network Connection",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Re-installing",
    "avStatusCategory": "In Progress",
    "tags": [
      {
        "name": "Test-TK",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "TestMadhuri",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Dynamic-test-EDR",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:43.899+0000",
    "avErrorCode": "Re-installing",
    "edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
  },
  {
    "hostName": "indra.centos7.edr.qualys.com",
    "avWorkflow": "UPDATE",
    "lastReportedTime": "2024-12-30T07:45:07.541+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "28",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "CentOS Linux 7.5.1804",
    "isAVUpToDate": false,
    "platform": "Linux",
    "lastLoggedOnUser": "root",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": false,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "ens192",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Update Error",
    "avStatusCategory": "Update Failed",
    "tags": [
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:44.970+0000",
    "avErrorCode": "DOWNLOAD_FAILURE",
    "edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
    "system": {
      "lastBoot": "2024-11-05 10:06:08",
      "timezone": "+05:30",
      "model": "VMware Virtual Platform",
      "manufacturer": "VMware, Inc."
    }
  }
]

Response Field DescriptionsResponse Field Descriptions

Dataset Name

Field Name

Data Type

Description

Asset hostName String The hostname of the asset.   
  lastReportedTime Timestamp Timestamp of the last reported EDR event (ISO 8601 format).  
  edrFunctionalStatus   String

EDR status of the asset.

  • Active: EDR is enabled , and the Last Reported Time is within 24 hours.
  • Inactive: EDR is enabled, but the Last Reported Time exceeds 24 hours.
  • Disabled: EDR is turned off. You can enable EDR from the Qualys Cloud Agent application.
   productUpdateErrorCode  Integer

Anti-malware update error code.

Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates.

  downloadPercent Integer Download status of AV installation or updates, expressed as a percentage (%).
  operatingSystem String

The operating system of the asset.

E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778

  platform String The platform of the asset (Windows or Linux or Mac.)
  isAVUpToDate Boolean Indicates whether the anti-malware is  updated to latest version (true or false.)
  lastLoggedOnUser String Indicates the most recent user who logged in to the endpoint.
  id String A unique identifier assigned to the agent installed on the asset.   
  isEDREnabled     Boolean Indicates whether EDR is enabled on the endpoint (true or false.)
  avStatus Boolean Indicates if AV is successfully installed on the endpoint (true or false.)
  antimalwareStatus String Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.)
  avStatusCategory String Displays the category or reason for the above-specified AV status.  
  avErrorCode String Indicates the error codes associated with AV installation or updates.
  edrActivatedOnDate Timestamp The date and time when EDR was activated on the asset.
  avProfile Object

The anti-malware profile associated with the asset.

Dataset: AVProfile

  interfaces Array of Object

List of interfaces associated with the asset.

Dataset: Interfaces

  tags Array of Object

List of tags associated with the asset.

Dataset: Tags

AVProfile name String The name of the AV profile.
  id String The unique identifier assigned to the AV profile.   
  status String The assignment status of the AV profile (e.g . ASSIGNED.)
Interfaces macAddress String The MAC address of the network interface.
  ipAddress String The IP address of the network interface.    
  interfaceName String The name of the network interface.   
  gatewayAddress String The gateway address of the network interface.
Tags     name String The name of the tag.
  uuid String The unique identifier for the tag.

V1.0

This API retrieves a large number of search results in smaller sections or batches. The API returns up to 5,000 events per request.

GET/ioc/v1/asset/all

Input Parameters for Fetch Asset ListInput Parameters for Fetch Asset List

Input Parameters

Mandatory/Optional

Format

Description

Authorization

Mandatory

String

Authorization parameter authenticates the Qualys Enterprise TruRisk™  Platform. Prepend token with "Bearer" and a space. For example: Bearer authToken.

filter

Optional

String

Filter the events list by providing a query using Qualys syntax. Refer to the How to Search topic in the online help for assistance with creating your query.

For example - event.datetime:["2024-09-15T00:30:00.000Z".."2024-09-22T18:29:59.999Z"] AND action: 'Created'

You can filter events based on the time they are generated on the event (event.datetime) or the time they are processed at Qualys (event.eventprocesstime). If you want to fetch events by date AND time, it is recommended to use the "event.datetime" or "event.eventprocesstime" parameter. 

pageNumber

Optional

String

The pageNumber parameter returns the page to be returned. It starts from the value zero

pageSize

Optional

String

The pageSize parameter mentions the number of records per page to be included in the response. The default value is 10.

include_attributes

Optional

String

include_attribute parameter includes certain attributes in the search. The search results generated are provided using a comma-separated list. The API response fetches only the included attributes.

For example: include_attributes = _type, _id, processName

exclude_attributes

Optional

String

exclude_attribute parameter excludes certain attributes from the search. The search results generated are provided using a comma-separated list.

For example: exclude_attributes = _type, _id, processName

Note:You need not exclude attributes if you have included specific attributes using the include_attributes parameter. Attributes that are not included are by default excluded.

sort

Optional

String

The sort parameter filters the asset by providing a query using Qualys syntax. For more information see EDR Online Help.

For example:asset.platform: 'Windows'

Sample - Fetch Asset ListSample - Fetch Asset List

API Request

curl -X GET "<qualys_base_url>/ioc/v1/asset/all" --header "accept: */*" -- header "Authorization: Bearer<token>"

Response

[
  {
    "hostName": "QBAS2",
    "lastReportedTime": "2024-12-09T14:36:08.605+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "0",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778",
    "platform": "Windows",
    "isAVUpToDate": false,
    "lastLoggedOnUser": "Administrator",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": true,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "Intel(R) 82574L Gigabit Network Connection",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Re-installing",
    "avStatusCategory": "In Progress",
    "tags": [
      {
        "name": "Test-TK",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "TestMadhuri",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Dynamic-test-EDR",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:43.899+0000",
    "avErrorCode": "Re-installing",
    "edrActivatedOnDate": "2024-12-04T07:25:09.000+0000"
  },
  {
    "hostName": "indra.centos7.edr.qualys.com",
    "avWorkflow": "UPDATE",
    "lastReportedTime": "2024-12-30T07:45:07.541+0000",
    "edrFunctionalStatus": "Inactive",
    "productUpdateErrorCode": "28",
    "downloadPercent": 100,
    "avProfile": {
      "name": "test-12345",
      "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
      "status": "ASSIGNED"
    },
    "operatingSystem": "CentOS Linux 7.5.1804",
    "isAVUpToDate": false,
    "platform": "Linux",
    "lastLoggedOnUser": "root",
    "id": "XXX8a87X-XXbb-4XX9-XX74-XXX08f6XX54X",
    "isEDREnabled": false,
    "interfaces": [
      {
        "macAddress": "00:X0:XX:0X:00:00",
        "ipAddress": "X0.1X.XX1.00",
        "interfaceName": "ens192",
        "gatewayAddress": "XX.XX.X0X.X"
      }
    ],
    "avStatus": false,
    "antimalwareStatus": "Update Error",
    "avStatusCategory": "Update Failed",
    "tags": [
      {
        "name": "test45",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "ProfileAssignTag",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      },
      {
        "name": "Cloud Agent",
        "uuid": "XXX676fX-cXX8-XX32-bfXX-XXX8XbcXXX1b"
      }
    ],
    "timeStamp": "2025-02-25T06:21:44.970+0000",
    "avErrorCode": "DOWNLOAD_FAILURE",
    "edrActivatedOnDate": "2024-10-28T09:49:09.000+0000",
    "system": {
      "lastBoot": "2024-11-05 10:06:08",
      "timezone": "+05:30",
      "model": "VMware Virtual Platform",
      "manufacturer": "VMware, Inc."
    }
  }
]

Response Field DescriptionsResponse Field Descriptions

Dataset Name

Field Name

Data Type

Description

Asset hostName String The hostname of the asset.   
  lastReportedTime Timestamp Timestamp of the last reported EDR event (ISO 8601 format).  
  edrFunctionalStatus   String

EDR status of the asset.

  • Active: EDR is enabled , and the Last Reported Time is within 24 hours.
  • Inactive: EDR is enabled, but the Last Reported Time exceeds 24 hours.
  • Disabled: EDR is turned off. You can enable EDR from the Qualys Cloud Agent application.
   productUpdateErrorCode  Integer

Anti-malware update error code.

Refer to this topic for error codes, descriptions, and troubleshooting steps for failed Qualys Anti-Malware updates: Troubleshooting Qualys Anti-Malware Error Updates.

  downloadPercent Integer Download status of AV installation or updates, expressed as a percentage (%).
  operatingSystem String

The operating system of the asset.

E.g. Microsoft Windows 8.1 Pro 6.3.9600 64-bit N/A Build 9600 UBR 20778

  platform String The platform of the asset (Windows or Linux or Mac.)
  isAVUpToDate Boolean Indicates whether the anti-malware is  updated to latest version (true or false.)
  lastLoggedOnUser String Indicates the most recent user who logged in to the endpoint.
  id String A unique identifier assigned to the agent installed on the asset.   
  isEDREnabled     Boolean Indicates whether EDR is enabled on the endpoint (true or false.)
  avStatus Boolean Indicates if AV is successfully installed on the endpoint (true or false.)
  antimalwareStatus String Indicates the current AV status for each asset or endpoint (e.g., Anti-malware Updated, Not Updated, Update Error, Failed to Install, etc.)
  avStatusCategory String Displays the category or reason for the above-specified AV status.  
  avErrorCode String Indicates the error codes associated with AV installation or updates.
  edrActivatedOnDate Timestamp The date and time when EDR was activated on the asset.
  avProfile Object

The anti-malware profile associated with the asset.

Dataset: AVProfile

  interfaces Array of Object

List of interfaces associated with the asset.

Dataset: Interfaces

  tags Array of Object

List of tags associated with the asset.

Dataset: Tags

AVProfile name String The name of the AV profile.
  id String The unique identifier assigned to the AV profile.   
  status String The assignment status of the AV profile (e.g . ASSIGNED.)
Interfaces macAddress String The MAC address of the network interface.
  ipAddress String The IP address of the network interface.    
  interfaceName String The name of the network interface.   
  gatewayAddress String The gateway address of the network interface.
Tags     name String The name of the tag.
  uuid String The unique identifier for the tag.

API Version History

The following table depicts the information about the different versions of this API along with the status:

API Version API Status Release Date
/ioc/asset/all Active  
/ioc/v1/asset/all Active May 2025