ETM data sources

ETM Data Sources are the applications and connectors that provide asset and finding data to ETM. ETM ingests data from multiple sources and combines the available information to provide a unified view of assets and security risk.

ETM ingests data from two types of sources:

Category	Examples	What it provides
Qualys native applications (pre-configured sources)	VMDR, CSAM, WAS, Policy Audit, SCA	Vulnerabilities, asset inventory, misconfigurations, and web application findings
Third-party connectors	CrowdStrike, Microsoft Defender, Wiz, SentinelOne, Prisma Cloud, Tenable	Asset and finding data from third-party security tools

Qualys Native Applications

Qualys native applications share the Qualys platform with ETM and are pre-configured. If your subscription includes one of these applications, its data is ingested into ETM automatically. The onboarding wizard lists them under Pre-Configured Qualys Sources.

Application	Provides	Purpose
VMDR	Vulnerability findings	Identifies vulnerabilities in the environment.
CSAM	Asset inventory	Provides information about assets in the environment.
Policy Audit	Misconfigurations (failed controls)	Identifies configuration issues and deviations from required policies.
WAS	Web application findings	Identifies vulnerabilities in web applications.

The same asset may have data from multiple Qualys applications. For example, a web server may appear in CSAM as an asset, in VMDR with vulnerability findings, and in Policy Audit with configuration findings. ETM correlates this information to provide a unified view of the asset and its associated risk.

Third-Party Connectors

Third-party connectors bring asset and finding data from security products outside the Qualys platform. ETM supports integrations with products such as CrowdStrike, Microsoft Defender, Wiz, SentinelOne, Prisma Cloud, and Tenable.

To see the connectors available to you, go to Configuration > Connectors > Marketplace.

You can onboard third-party data using the following methods:

CSV: Upload data exported from the third-party product, for example, by using the Generic CSV connector.
API: Connect ETM to the third-party product so that data can be retrieved automatically.

Choose a Data Source

Select a data source based on the type of data you need to bring into ETM and the location of that data. Qualys native applications generally require less configuration, while third-party sources may require additional setup.

Example: Bring Data from Multiple Security Sources

Consider an organization that uses Qualys VMDR to identify vulnerabilities on servers and Microsoft Defender to monitor endpoint security. The organization can connect both data sources to ETM.

VMDR provides vulnerability information for the servers, while Microsoft Defender provides additional endpoint findings. ETM combines the available information and presents the security risk associated with the same asset in a unified view.

This approach is useful in environments that use multiple security products. Instead of reviewing findings separately in each product, analysts can use ETM to consolidate available data and obtain a more complete view of organizational security risk.

Primary Data Types

The primary types of data used by ETM include:

Data type	Description
Asset data	Information about the assets in your environment, such as servers, endpoints, cloud resources, and other entities.
Finding data	Security findings associated with assets, such as vulnerabilities and other supported security issues.
Business data	Information that describes the business importance, ownership, or context of assets and applications.
Threat intelligence	Information that provides additional context about threats and threat activity relevant to assets or findings.

Asset data

Asset data establishes the foundation for understanding your environment. It identifies the assets that ETM can associate with findings, business context, and other risk information. For more information about assets, see Core ETM Concepts.

Depending on the source, asset data can include:

IP addresses
Hostnames and FQDNs
Operating system information
Cloud provider and resource information
Asset type
Location
Tags and classifications
Asset identifiers
Business-related attributes

ETM uses available asset attributes to identify and correlate assets across Qualys and third-party data sources. To review how assets are matched, see the Asset Identification and Reconciliation rules in Inventory > Rules.

For example, a server may be identified by its IP address in one source and by its hostname or cloud resource ID in another source. ETM uses available identifiers and attributes to determine whether the records represent the same asset.

Finding data

Finding data identifies security risks associated with your assets.

Depending on the source, finding data can include:

Vulnerabilities
Detection information
Severity
Finding status
Affected assets
Finding identifiers
Configuration-related security issues
Other source-specific security findings

ETM associates findings with the relevant assets so that the findings can be evaluated in the context of their business impact.

For example, a vulnerability affecting a production server can be analyzed together with information about that server, its business importance, and other available risk context.

ETM uses finding identification rules to recognize the same finding reported by different sources. For example, a vulnerability is matched by asset and CVE ID, together with port and protocol when available. Merge rules then combine the values, keeping the earliest First Found date, the latest Last Found date, and the status from the latest detection. To view these rules, go to Risk Management > Finding Rules.

Business data

Business data provides information about the business context of assets and applications. This information helps ETM understand the importance of an asset beyond its technical attributes.

Business data can include:

Business application
Business service
Asset owner
Business unit
Department
Environment
Business criticality
Organizational classification

The availability of business data depends on the configured source and supported integration.

For example, two assets may have similar vulnerabilities, but one may support a critical customer-facing application while the other may be used for development. Business context provides additional information that can be considered when analyzing the associated risk.

Threat intelligence

Threat intelligence provides additional context about threats and threat activity that may be relevant to assets or findings.

When available, threat intelligence can help provide context such as:

Relevant threat activity
Threat indicators
Associations between threats and affected assets
Additional context for security findings

Threat intelligence complements asset, finding, and business data. It does not replace these data types.

For example, a vulnerability on an asset provides information about a technical security issue. Business information can indicate that the asset supports a critical service, while threat intelligence can provide additional information about relevant threat activity. ETM uses this information together to provide broader risk context.