Data Flow in ETM

ETM brings together security and business data from multiple sources and transforms it into a unified view of your organization's risk. Because different tools collect and represent data in different ways, ETM processes the data through a series of stages before presenting it as actionable insights.

The data flows through six stages:

Sources → Ingestion → Normalization → Correlation → Enrichment → Insights

At each stage, ETM adds context and structure to the data, making it more consistent, accurate, and useful for risk analysis.

Example: This approach is similar to how a SIEM processes log data. Firewalls, endpoints, and cloud services generate event data in different formats. A SIEM collects these events, normalizes them into a common format, correlates related events, and enriches the data with additional context before presenting alerts to analysts.

ETM applies the same principle to risk data. It consolidates data from various security and business systems, creates a unified view of assets and findings, adds relevant business and threat context, and transforms it into actionable risk insights that help organizations understand and prioritize risk.

1. Data sources

The workflow begins with data sources that provide information to ETM.

These sources can include Qualys applications such as VMDR, CSAM, Policy Audit, and TAS, as well as third-party sources such as Wiz, CrowdStrike, and ServiceNow.

Each source provides different types of information. For example, VMDR provides findings, CSAM provides asset information, and a third-party connector may provide various other asset details.

ETM brings this information together to create a single view of organizational risk.

2. Ingestion

Once a source is connected, ETM ingests its data. Ingestion is the process of importing data from a source into ETM.

At this stage, ETM has source data available for processing, but the data may still retain the source-specific format, structure, and terminology.

3. Normalization

Normalization is the process of converting source-specific data into a common ETM data model, enabling consistent scoring, correlation, and analysis across diverse security data sources. Different tools often describe the same asset, vulnerability, or finding using different identifiers, fields, or formats. ETM standardizes this information, including CVEs, asset identifiers, and other metadata, into a unified structure for consistent comparison and analysis.

Example: Two security tools may use different names or fields to describe the same vulnerability. ETM transforms these records into a common structure, allowing them to be correlated and evaluated together.

Note: For existing Qualys customers, the most significant impact of normalization is how findings are represented in ETM. ETM organizes findings around CVEs, while VMDR continues to use QIDs. The underlying detection remains the same; only the method used to organize and correlate findings within ETM differs.

4. Correlation

After the data is normalized, ETM correlates related records from different sources to determine whether they represent the same asset. By identifying and linking related records, ETM creates a single, unified asset record that provides a more complete and accurate view of your environment.

ETM uses Asset Identification Rules to determine whether records from multiple sources belong to the same asset. These rules evaluate available asset attributes, such as hostnames and unique identifiers, to establish a match.

For example, a laptop may be discovered by multiple security and IT management tools, each using different hostnames, identifiers, or metadata. ETM applies Asset Identification Rules to recognize that these records refer to the same asset and correlates them into a single asset record.

For more information, see Asset Identification Rules.

5. Enrichment

Once assets and findings have been normalized and correlated, ETM adds additional context through enrichment to provide a complete understanding of risk.

Enrichment can include:

• Threat intelligence: Information about current and emerging threats, such as whether a vulnerability is actively exploited or associated with ransomware.
• Business context: Information about asset ownership, business function role, and importance within the organization.
• Asset criticality: An indication of how important an asset is to business operations and the potential impact if it is compromised.

This context helps ETM determine not only the technical severity of a finding, but also its potential impact on your organization.

The enriched data is then used as input to calculate the TruRisk score, helping organizations assess and prioritize risk.

6. Insights

ETM uses enriched assets, finding, threat, and business context data to generate actionable insights that help you understand and prioritize risk across your environment.

These insights are presented through dashboards, reports, TruRisk™ Scores, and remediation prioritization views. By combining information gathered during normalization, correlation, and enrichment, ETM provides a clear view of your overall risk posture and highlights the risks that require the most immediate attention.

Rather than simply collecting and aggregating security data, ETM transforms that data into meaningful intelligence that supports informed decision-making. This enables security teams to focus their efforts on the highest-priority risks, accelerate remediation, and improve overall risk management outcomes.