ETM EASM Integration
Qualys External Attack Surface Management (EASM) shows you your organization the way an outside attacker sees it. It continuously monitors your external attack surface and internet-connected assets, tracks changes, and notifies you when new assets, unknown assets, or critical issues appear, so that you can identify and assess security and compliance gaps in your network as they emerge.
Integrating EASM with Enterprise TruRisk Management (ETM) brings that outside-in view into your risk workflow. EASM findings appear as vulnerabilities in ETM's unified risk management interface, where an exposed asset you did not know about is ranked against everything else in your environment.
Each finding carries the detail you need to act: the affected asset, the severity, the current status, and any known exploits or associated malware. That lets your security team prioritize remediation by real risk and potential impact, without switching between management interfaces.
At a Glance
| What ETM ingests | Findings on internet-facing and previously unknown assets, ingested as vulnerabilities |
|---|---|
| Where to view | Risk Management > Findings > Vulnerabilities |
| QQL filter | finding.vendorProductName:EASM |
| How data arrives | Automatic ingestion after you run a baseline, through Discovery and VM scans |
| Detail tabs available | Summary, QDS Details, Detection Details, Exploitability, Patches, Malware, Sources |
Prerequisites
CSAM or EASM must be enabled for your subscription before you can implement the EASM integration with ETM.
How the Integration Works
- Contact your Technical Account Manager (TAM) or Qualys Support to enable EASM for your subscription.
- Run a baseline for EASM to ingest your existing EASM data into ETM.
ETM then ingests findings from EASM as vulnerabilities.
After the baseline, the integration keeps both systems synchronized, so the security posture information in ETM stays current for risk management.
Note: EASM ingests data through both Discovery and VM scans. Data obtained through Discovery appears in Finding Details with the Detection Method listed as Discovery; data collected through VM is labeled VM. Use this field when you need to know how thoroughly an asset has been assessed.
View Assets and Findings in ETM
After completing the integration, you can view and manage EASM findings within the ETM interface.
- Navigate to Risk Management > Findings > Vulnerabilities to access the consolidated view of security posture findings.
- To filter for EASM findings only, use the following QQL query:
finding.vendorProductName:EASM - To see the details of a vulnerability, select it and click View Details from the Quick Actions menu. The details open in the tabs described below.
Summary
Your starting point for any finding. The Summary page collects Basic Details, Description, and asset Information, along with cards for Exploits, Patches, and Malware. Basic Details include the Finding ID, the Type Detected, and whether the finding has been Confirmed. You also see Sources and the first-detected and last-detected dates.
QDS Details
Explains why the finding scored the way it did. The Qualys Detection Score (QDS) Details tab shows the Contributing Factors behind the score, plus Additional Insights such as Technical Attributes, Temporal Attributes, Trending, and Remediation.
Detection Details
Shows how the vulnerability was proven and what to do about it: Parameters, Payloads, Payload Details, Rationale (detection logic), Impact, and Recommendations / Remediation Guidance.
Exploitability
Tells you whether attackers already have a way in. The Exploitability tab lists known exploits for the vulnerability from third-party vendors and publicly available sources.
Patches
Lists the patches available for the vulnerability. This feature is not currently available for EASM findings.
Malware
Shows malware known to be associated with the vulnerability, including Malware ID, type, Platform, and Risk.
Sources
Traces the finding back to where it came from. The Sources tab shows Title, CVE ID, Status, Category, Sources, Last Detected, First Detected, Port, and Finding ID. Source Records lists the source, Title, Status, first detected, and last detected.
