FAQs and Troubleshooting: Agent Insta

This section helps you quickly resolve common questions and issues when using Agent Insta.

Frequently Asked Questions

Find answers to common questions and guidance for resolving issues with Agent Insta.

Agent Insta and your existing VMDR detection

Does Agent Insta replace my VMDR scans or Cloud Agent detections?

No. Agent Insta adds a detection source alongside your existing scanners, Cloud Agents, and third-party connectors. It does not change, pause, or replace them. Where InstaScan and a scan-based or agent-based detection report the same vulnerability on the same asset, the finding is shown once with both sources listed on the Sources tab.

How does Agent Insta detect a vulnerability without running a scan?

Detection is advisory-driven rather than scan-driven. Agent Insta checks advisory sources at regular intervals, enriches the advisory data using software identification, and matches it against the software inventory already known for your assets. Because the evidence comes from inventory rather than from an active probe or an on-host agent check, no scan needs to run against the asset for a finding to be published.

An asset shows a Qualys vulnerability, but it has no Qualys sensor. Is that expected?

Yes. Agent Insta derives detection from software inventory rather than from an active scan, including inventory supplied by third-party connectors such as CrowdStrike Spotlight. An asset whose only source is a third-party connector can therefore carry a Qualys-flagged vulnerability.

What happens when a scanner or Cloud Agent later reports the same finding?

The finding is not duplicated. The InstaScan icon in front of the finding title is displayed only while InstaScan is the sole source of that finding. Once a scanner, Cloud Agent, or third-party source also reports it, Agent Insta removes the icon and updates the Sources tab to show both InstaScan and the other source.

How do I tell InstaScan findings apart from my scan-based findings?

InstaScan findings appear in Risk Management with your other findings. To isolate them, query instaScan: true on the findings page, or open the InstaScan card on the Agent Insta page. Note that the view opened from the agent page is scoped to the last 30 days.

Set Up and Run Agent Insta

Cannot find Agent Insta in your account?

This can happen for one of the following reasons:

• The InstaScan feature is not enabled for your subscription or your user role. Contact your administrator or manager to verify that agent features are enabled for your account and that you have the required permissions.

• You are looking in the Marketplace. Agent Insta is not listed in the Marketplace and does not need to be hired. The Marketplace lists the interactive agents, for example Agent Sara and Agent Sophia, to whom you assign tasks. Agent Insta appears under Cyber Risk Agents automatically once the feature is enabled.

Why can I not assign a task to Agent Insta?

Agent Insta is not an interactive agent. Its role is to configure and keep the InstaScan running, so it uses a single saved configuration instead of tasks.

How often does Agent Insta run, and can I schedule it?

There is no schedule to set. Detection is advisory-driven: Agent Insta checks advisory sources at regular intervals and publishes findings once it has enriched the advisory data using software identification. Once you save the configuration, InstaScan runs on its own.

Not sure how to configure Agent Insta?

Review the Configuration section for details of Scope Type, Include Tags, Last Seen, and Asset Criticality Score. For details, refer to Getting Started with Insta.

Can I combine Last Seen and Asset Criticality Score with OR?

Yes. Both AND and OR operators are available.

Troubleshooting

Use this section to resolve issues with enabling, scoping, and viewing InstaScan results.

The InstaScan tab is not visible under Configuration

Likely cause: The InstaScan feature is not enabled for your subscription. The tab is hidden while the feature is disabled. Contact Qualys Support or your Technical Account Manager.

Summary cards on the Agent Insta page are empty

Likely cause: The InstaScan configuration has not been saved. On the first visit, the configuration page is disabled. Enable InstaScan, complete both steps of the Window, and click Finish Configuration.

Fewer findings than expected

Likely cause: Scope is narrower than intended. Verify your Include Tags selection, check that assets have been seen within the Last Seen window - by sensor type, scan, or connector refresh - and confirm their Asset Criticality Score meets your threshold. Because the two criteria are joined by AND, an asset failing either one is excluded.

Not seeing InstaScan findings in Risk Management

Likely cause: Filters on the findings page are excluding them. Clear existing filters and query IsInstaScan: true, or use the InstaScan card. Also, check the date range, since the view opened from the agent page is scoped to the last 30 days.

The icon in front of the finding title has disappeared

Answer: This is expected behavior, not an error. See What happens when a scanner or Cloud Agent later reports the same finding? in the FAQs above.