Real-World Use Cases: Agent Insta

This section guides you on how to use Agent Insta.

Quick Command Reference

Agent Insta runs continuously once configured, so there is no run schedule to follow. Instead, these are the queries and views you will return to most often:

• All InstaScan findings
  IsInstaScan: true
• Recent InstaScan findings
  Combine IsInstaScan: true with a date filter, for example, now through the last 30 days - this is the query opened by clicking the findings count on the Agent Insta page
• InstaScan findings without a scan-confirmed source
  Look for the icon in front of the finding title, which is displayed while InstaScan is the only source
• Filter without a query
  Use the InstaScan card on the Risk Management page

Use Case 1: Impact of Newly Published Advisory on Your Assets

Scenario: A vendor has just published an advisory with new CVEs. Your next scan window is days away, and you need to know now whether your environment is exposed.

What to Do

Nothing to trigger - Agent Insta picks up the advisory automatically. Open the Agent Insta page and click the findings count, or query IsInstaScan: true in Risk Management, and sort by first found date.

What You Get

• Confirmed findings on in-scope assets, with first found dates
• Visibility into exposure before any scan has run against the affected assets
• A working list you can triage while the scan cycle catches up

What to Do

Include the relevant tags - for example, Unmanaged or Passive Sensor in your InstaScan Include Tags selection, and set Last Seen wide enough that these assets remain in scope.

What You Get

• Findings on assets that no scan has reached
• Findings marked with the title-level icon, identifying exposure, InstaScan alone has surfaced
• A concrete picture of the exposure hidden in the unscanned portion of your estate
• Evidence to support extending sensor coverage to those assets

Use Case 2: Detection on Third-Party Connector Assets

Scenario: An asset is known to Qualys only through a third-party connector - for example, its only source is CrowdStrike. You still need Qualys-quality vulnerability detection on it.

What to Do

Add the connector, then include its tag - for example, CrowdStrike Spotlight in your InstaScan configuration. Agent Insta uses the software inventory supplied by the connector as its detection input.

What You Get

• Qualys-flagged vulnerabilities on assets whose only source is the third-party connector
• Findings visible in Risk Management with Qualys InstaScan as the source
• Detection coverage that extends the moment a connector is added, with no scan configuration required
• A detection capability that was not previously available for third-party sources at all
• A single findings view spanning first-party and third-party inventory