Qualys Dataflow for TotalAppSec (TAS) Connector

Before configuring the connector in Qualys ETM, ensure the following prerequisites are in place.

1. Ensure you have an active Qualys TotalAppSec (TAS) subscription.
2. Generate a user-level Client ID and Client Secret from your Qualys profile. Navigate to your profile page, locate the Auth ID Client Management section, and create a new user-level client. Copy the Client Secret immediately — it is displayed only once.
3. Note that TotalAppSec supports only user-level client credentials. Subscription-level credentials are not supported.
4. Have your Qualys Gateway URL ready. This can be found at the Qualys Platform Identification page (for example, https://gateway.qg1.apps.qualys.com).

Generating Client ID and Client Secret

Follow the steps below for generating the Client ID and Secret.

1. Log in to the Qualys platform with your user credentials.
2. Click your avatar and select View Profile to navigate to your profile page.
3. Locate the Auth ID Client Management section.
4. Click to create a new user-level client. The system will generate a Client ID and Client Secret.

Important: Copy the Client Secret immediately - it is displayed only once at the time of creation and cannot be retrieved later. If you lose the Client Secret, you must generate a new one.

TotalAppSec supports only user-level client credentials. Each user generates their own Client ID and Client Secret from their profile page. Subscription-level credentials are not supported and will result in authentication failures.

Permissions Required

The Qualys user account must have an active TotalAppSec subscription and API access enabled. The Client ID must be created at the user level (not subscription level), as TotalAppSec currently supports only user-level client credentials.

Scope and Data Access

The connector queries TotalAppSec endpoints to retrieve Application and API Collection assets along with their associated vulnerability findings. Delta synchronization is supported for ongoing runs after the initial full pull. The data flow is unidirectional, from TotalAppSec to Qualys ETM. The following API endpoints are queried during each connector run:

Key Rotation

When rotating credentials, generate a new Client ID and Client Secret from the Auth ID Client Management section on your Qualys profile page. Update the credential in Qualys ETM via the Edit Connector option and enter the new values. The old client can be removed after the new one is confirmed to be working.

The connector setup wizard consists of three steps: Profile & Connectivity, Scope & Schedule, and Review & Confirm. Follow the steps below to create a profile and connection.

Follow the steps below to create a profile and connection.

1. Go to Qualys ETM and navigate to Connectors > Integration.
2. Locate Qualys Dataflow for Total AppSec in the Connector Marketplace and click the Add button to add it to your account. 
   If the connector is already added to your account, then navigate to My connectors and search for Qualys Dataflow for Total AppSec connector from the list.
3. Click Manage Connections on the Qualys Dataflow for Container Security connector tile and then click Create Connection. 
4. Provide the connection profile information.
5. Configure authentication details.
6. Run Test Connection.
7. Click Next.

Connector Details

Authentication Details

Provide the authentication details for the connection under the Authentication Details section.

The Client Secret is shown only once at the time of generation in Qualys TotalAppSec. If you did not copy it when it was created, you must generate a new Client ID and Client Secret pair before continuing.

After entering all authentication fields, click Test Connection to validate connectivity before proceeding. The following checks are performed:

• Network Reachability
• TLS Handshake
• Authentication Credential Check
• Authorization Scope Check
• Data Fetch

If the Test Connection returns error message displaying Some unexpected error occurred, check the Gateway URL matches your Qualys platform region, the Client ID was created at the user level (not subscription level), and the Client Secret has not been regenerated since it was entered. If your environment uses IP restrictions, ensure the Is IP Restricted checkbox is enabled. See Troubleshooting for additional guidance.

Click Next once the Test Connection is successful. 

To ingest the data from TotalAppSec and configure when the connector should run, follow the steps below.

1. Select the data types to synchronize and configure the execution schedule. 
2. Select the supported sync option as Assets & Findings. 
3. Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest.
4. Configure a schedule as single occurrence or a recurring occurrence with start and end dates/times.
5. Select the Assets values. The values are "APICOLLECTION"," APPLICATION". 
6. Click on Next button.

The schedule timezone is derived from your browser locale at the time of configuration (for example, Asia/Calcutta). The five-year end date is set automatically. You can review the exact start date, end date, start time, end time, and frequency on the Review & Confirm screen before creating the connector.

Advanced Settings

Use the Advanced Settings to configure filtering and transformation options, set the data ingestion starting point, and control the data to ingest. 

1.  Tag Filter: Enter comma-separated tag values to limit data ingestion to assets that match the specified tags.

2. Asset Types: Select the asset types to ingest.

The connector supports chip-based asset type filtering. The Available asset types are:

• API Collection – imports API Collection assets from TotalAppSec.
• Application – imports web Application assets from TotalAppSec.

3.  Findings: The Findings dropdown helps you select supported findings categories. The findings type is fixed at Vulnerability. This field is a dropdown and is pre-populated; You can also filter based on the required TruRisk Score or a specific date when the asset was modified.

Transform Map

The Transform Map tab displays the active transformation maps used during connector execution. Default maps are provided and applied automatically. You can clone or customize them in the ETM administration interface if needed.

Two active transformation maps are defined for this connector:

• Application Mapping
• API Collection Mapping

Refer to Transformation Maps in the Additional Information section for the complete field mapping tables.

Save the changes after modifying filter selections in Advanced Settings.

What This Connector Does

The Qualys Dataflow for TotalAppSec connector retrieves Application and API Collection asset records from TotalAppSec, along with their associated vulnerability findings, and imports them into Qualys ETM. Asset records include application URLs, identifiers, and metadata. Vulnerability findings include details such as CVE identifiers, CVSS scores, severity ratings, and finding descriptions. ETM then correlates this application-layer risk data with other asset types to surface unified exposure insights across the attack surface.

How Authentication Works

The connector authenticates using OAuth 2.0 with a user-level Client ID and Client Secret generated from the Qualys platform. These credentials are provided alongside the Gateway URL during connector configuration in Qualys ETM. TotalAppSec supports only user-level client credentials; subscription-level credentials are not supported.

Review the connection, then click the Create button. After creation, the connector appears in the Connections list with an initial state of Registered.