Best Practices for Using Agent Insta

Use these practices to get consistent results from Agent Insta. Each practice gives the reasoning behind it and the steps to apply it.

Scope Deliberately Rather Than Broadly

Why

Agent Insta uses your saved configuration to keep detection focused on what matters most to you. A scope that includes everything produces findings you will not triage, which dilutes the value of fast, AI-driven detection.

How

Select only the tags that represent assets you will act on, then use the Asset Criticality Score to raise the floor. Remember that Last Seen and Asset Criticality Score are combined with AND, so both conditions must be satisfied for an asset to be in scope.

Set Last Seen to Match Your Data Refresh Rate

Why

An asset is considered recently seen by its sensor type, a scan, or a connector refresh. If Last Seen is shorter than the interval at which your connectors refresh, assets will drop out of scope and stop being monitored even though nothing has changed about them.

How

Check how often each inventory source refreshes, then set Last Seen comfortably wider than the slowest one. Revisit the setting whenever you add a source with a different refresh cadence.

Add Connectors to Extend Coverage

Why

Agent Insta's detection is not limited to first-party sources. Adding a connector immediately makes its software inventory usable for detection, which is how an asset whose only source is CrowdStrike can still return a Qualys-flagged vulnerability.

How

Onboard connectors for inventory not yet covered by a Qualys sensor, then include their tags in the InstaScan configuration so the newly visible assets fall in scope.

Pay Attention to InstaScan-Only Findings

Why

An icon in front of the finding title means InstaScan is the only source that has reported it. Once another vendor reports the same finding, that icon is removed. Findings that keep the icon therefore mark exposure your scan and agent coverage has not reached.

How

Review these findings first, and treat a persistent cluster of them on the same asset group as a signal to extend sensor coverage there.

Use the InstaScan Token for Reporting

Why

Agent Insta exposes the IsInstaScan QQL token and the InstaScan filter card to isolate its findings from all other sources. Separating them lets you measure the contribution of scanless detection.

How

Build saved searches on IsInstaScan : true, combined with a date range, and use them for periodic reporting on detection speed and coverage.