Active Directory Assets

You can find the following details from the Asset Summary tab:

Geolocation of Assets

Qualys determines the geolocation of your assets based on their public IP addresses. Asset Geolocation is enabled by default for customers in the United States. When an asset has at least one valid public IP, its last known location appears on the world map in Asset Details > Asset Summary.

To identify a public IP for geolocation, Qualys evaluates the following sources:

• The asset’s network interfaces for any public IP address
• For agent-based assets, the public IP reported by the Cloud Agent
• For AWS EC2 assets, the instance’s assigned public IP
• For assets discovered via network scans, any public IP associated with the scanner used
• If no public IP is detected from any of these sources, the asset’s location is shown as Unknown.

If you want to enable or disable Asset Geolocation for your subscription, contact Qualys Support.

The System Information tab provides a comprehensive view of an asset’s technical profile, including operating system details, hardware specifications, volumes, processors, GPU information, services, users, and any custom attributes added for that asset.

This tab displays detailed information grouped into the following sections:

Custom Attributes

You can add Custom Attributes to an asset to support filtering and metadata classification. Click Add Attributes to define a new attribute. Each attribute requires a Key and a Value.

You can assign up to 20 custom attributes per asset.

This feature is not available for users with a free CSAM subscription.

Confidence Levels for Unmanaged Assets

There is confidence associated with Hardware, and OS reported for unmanaged assets sensed by PS, as the PS fingerprints the asset based on the metadata it sees from the traffic copy fed to the NPS appliance, and does not actively query the asset. The operating system and hardware confidence details are displayed on the System Information page of the asset details, in the Operating System and Hardware sections.

You can view the details, including information about the network connection to the asset, such as IPv4 and IPv6 addresses, MAC Address, Netmask, and Manufacturer/Introduction Date, in the Network Information tab.

The Open Ports tab displays all network ports detected on the asset along with details about the services running on those ports. This information helps you assess exposure, identify unauthorized services, and track changes over time.

The system automatically classifies ports into three categories:

• Authorized Ports: Ports that have been marked as approved for use on the asset.
• Unauthorized Ports: Ports that are open but have not been approved and may require investigation.
• Needs Review: Ports that require additional validation before they can be classified as authorized or unauthorized.

The following port details are displayed:

You can export the port list using the Download option.

The Installed Software tab provides a consolidated view of all software detected on an asset. This view helps you understand the software inventory, identify outdated or unsupported software.

The following software details are displayed:

The Software Instances tab provides visibility into the running instances of databases, middleware, and other software detected on an asset. This view helps you understand which software is actively running, the associated ports, underlying technologies, and how the instance was discovered.

The following instance details are displayed:

You can see the traffic details for Clients and Servers, such as to and from date details, Total Ingress, and Total Egress from the Traffic Summary tab.

The Business Information tab provides business context for an asset by mapping it to ownership, environment, support structure, and associated business applications.

The Business Information is displayed:

Edit Basic Information

You can update the business information associated with the asset by clicking edit icon.

The TruRisk™ Score tab provides a detailed, asset-level view of risk by correlating technical findings with business context. It helps you understand how risky an asset is, why it is risky, and which factors contribute most to that risk, enabling effective prioritization and remediation.

Asset overview

At the top of the page, you can view the primary asset details, including:

TruRisk™ Score overview

The TruRisk™ Score represents the overall risk associated with the asset and is derived from:

• Business criticality of the asset
• Security risk factors
• Asset location within the network

The score is categorized into the following severity levels:

• Low
• Medium
• High
• Severe

If the TruRisk™ score is not yet calculated, a message is displayed prompting you to scan the asset to generate the score.

TruRisk™ Calculation details

This section explains the TruRisk™ calculation formula, showing how multiple contributing factors are aggregated to compute the final score. It provides transparency into how business context and security findings influence risk scoring.

The factors that contribute to the TruRisk™ Score are shown as individual tabs. Each tab represents a specific risk domain and displays how that factor contributes to the overall TruRisk™ in aggregation.

TruRisk™ Score contributing factors:

• CSAM Trial or Paid user with VMDR enabled:
  Vulnerabilities detected by VMDR, along with CSAM TruRisk calculation factors, contribute to the risk contributors and generate the TruRisk™ Score.
• CSAM Trial or Paid user without VMDR enabled:
  Only CSAM TruRisk calculation factors contribute to the risk contributors, and the TruRisk™ Score is generated based solely on CSAM risk factors.

Vulnerabilities tab

You can view the vulnerabilities detected for the asset from the Vulnerabilities tab. By default, the detailed list of vulnerabilities is shown based on Critical and High QDS vulnerabilities. You can also choose to include other vulnerabilities.

The detailed vulnerability details include the QID, Title, date when the vulnerability was detected, Source, Severity, and QDS. The Qualys Detection Score (QDS) is calculated, considering the CVSS score and the vulnerability context to prioritize remediation actions.

If the asset is activated for the VM module, you can choose to patch the vulnerability by clicking Patch Now. You can also patch multiple vulnerabilities by selecting the checkboxes next to the QID of required vulnerabilities. If you want to patch all the vulnerabilities on the page, select the checkbox next to the Actions Menu. Then, you can add it to an existing or a new job.

You can also download the vulnerability details in the CSV format.

Misconfigurations tab

You can view the misconfigurations detected on your assets. The detailed misconfigurations include the Title,Technology/Category, QVSS Base, Sources and LifeCycle.

The Certificate Instances tab provides visibility into digital certificates detected on the asset. This view helps you monitor certificate usage, understand where certificates are deployed, and identify potential security or compliance risks related to certificate configuration and lifecycle.

The following Certificate Instance details are displayed:

The Summary tab displays the origin of the asset and its correlation across external sources. This section helps you understand which integrations identified the asset, when it was discovered, and how it is tracked in the source system.

The following asset source information is displayed:

Asset Identification Log

The Identification Logs section provides detailed logs showing how the asset was identified and matched across data sources.

The Passive Sensor tab provides the details of the sensor that reported the asset. However, ICS_OCA tagged assets are created from the project file that is uploaded by the user in the "VMDR OT module". Hence, the passive sensor information is not applicable for such assets and therefore not shown on the Passive Sensor tab.

The Cloud Agent Passive Sensor (CAPS) tab provides passive discovery details collected by the Qualys Cloud Agent.

The following information is displayed:

From the Agent Summary tab, you can see the information of the agent from where the asset is collected.

You can see alert notification details that are applicable to the asset. The alert notifications are set from the Continuous Monitoring application. If the alert notifications set are not applicable to the asset, you can see the text No Alert Notifications.

The connector sources that discovered the asset are displayed under the SOURCES section. You can click each connector source to view its details, including custom and identification attributes.