Release 4.4

January 06, 2025

What's New?

New Feature: Audit Trail for FIM Profile

With this release, we have introduced audit trail for FIM profile. An audit trail is a record of events, including file changes and user activities, that helps track actions. 

Benefits
  • Maintaining audit trails in a FIM policy ensures accountability and compliance.
  • Viewing actual change using JSON object.
Key Points

You can find the following activities in the audit trail.

  • Create a new profile
  • Update in a profile
  • Delete a profile
  • Add and delete rules in profile
  • Add and delete assets in profile
  • Add and delete tags in profile

You can view the Audit trails in the Activity Logs tab of the Administration module.

View Activity log.

To know more about the audit trail, refer to FIM Online Help.

New Feature: Import Profile 

With this release, we have introduced a new feature to import profiles for enhanced convenience and organization. You can import multiple profiles in a single go. It creates multiple profiles based on the unique ID and profile name present in the CSV file.  You can save the file for reuse on your local machine and can import it and customize it as per your requirements.

Benefits
  • Efficiency in Configuration
    Having a profile configured on one account allows for easy reuse and import into other accounts, saving time and reducing manual setup efforts.
  • Bulk Editing Capability
    Making changes to multiple profiles using CSV files simplifies the process. You can update settings in bulk without navigating through the user interface for each profile, which enhances productivity.
  • Flexible Bulk Settings 
    You can easily adjust or replace specific settings in bulk, making it adaptable to changing requirements or configurations.
  • Simplified Profile Management
    The ability to manage and modify multiple profiles simultaneously through a CSV file streamlines profile handling and organization.
  • Time-Saving Solutions
    The overall process of importing, exporting, and editing profiles becomes quicker, allowing for faster adjustments and deployments.

You can select multiple profiles and from the Actions menu, choose Import Profile.

choose Export Profile.

Enhancements in Dashboard

With this release, we have made several enhancements to the Dashboard. We have introduced new Widgets and renamed a couple of them for easy identification of functions from their names and improved query suitability for the function.

New Dashboard Widgets

We have added the following new widgets

  • User Impersonation
    Get a count of the events generated by impersonated users.
  • Non-compliant (Non-Communicating) Assets
    Get a count of assets that have not been communicated for more than 7 days.
  • Non-compliant (Bad Agent Health Status)
    Get the count of Assets where Agent has reported bad health status to Qualys platform indicating that FIM is not working on the host.

Updated Widgets Name and Queries

We have renamed the widgets to be more suitable for functions and ease of understanding.

Refer to the following table for details.

We have updated back tick (`) with a single quote (') in the query

Existing Title New Title Existing Query New Query
Delete activity by non-privileged users on Linux Delete activity by regular users on Linux platform:Linux and action:Delete and not (actor.userName:`root`) platform:Linux and action:Delete and not (actor.userName:'root'
Delete activity by non-privileged users on Windows Delete activity by standard users on Windows platform:Windows and action:Delete and not (actor.userName:`NT AUTHORITY` or actor.userName:`Admin istrator`) platform:Windows and action:Delete and not (actor.userName:'NT AUTHORITY ' or actor.userName: ' admin ' )
Permission or Ownership changes by non-privileged users on Linux Permission or Ownership changes by regular users on Linux platform:Linux and action:Security and (actor.process:`chmod` or actor.process:`chown`) and not (actor.userName:`root`) platform:Linux and action:Security and (actor.process:'chmod' or actor.process:'chown') and not (actor.userName:'root')
Log file deletion on Linux host No Change platform:Linux and file.fullPath:`/var/log` and action:Delete platform:Linux and file.fullPath:'/var/log' and action:Delete
Security Log deletion on Windows host No Change platform:Windows and file.fullPath:`C:\\Windows\\System32
winevt
Logs` and action:Delete
platform:Windows and file.fullPath:'C:\\Windows\\System32
winevt
Logs'and action:Delete
Unauthorized modification critical authentication files on Linux No Change (platform:`Linux` and (file.name:`passwd` or file.name:`shadow` or file.name:`password-auth` or file.name:`system-auth` and (action:Delete or action:Security or action:Content)) and not actor.userName:`root`) (platform:'Linux' and (file.name:'/span>passwd' or file.name:''or file.name:'password-
auth' or file.name:'system-auth' and (action:Delete or action:Security or action:Content)) and not
actor.userName:'root')
Update process on Debian-Ubuntu systems No Change actor.userName:`root` and (actor.process:`apt-get update` or actor.process:`apt` or actor.process:`dpkg` or actor.process:`unpack` or actor.process:`dpkg-deb` or actor.process:`update-info-dir` or actor.process:`apt-get clean`) actor.userName:'root' and
(actor.process:'apt-get update' or actor.process:'apt' or actor.process:'dpkg' or actor.process:'unpack' or
actor.process:'dpkg-deb' or actor.process:'update-info-dir' or actor.process:'apt-get clean')
System updates on Red Hat-based Linux systems No Change actor.userName:`root` and (actor.process:`dnf` or actor.process:`yum` or actor.process:`rpm` or actor.process:`python` or actor.process:`update-alternatives`) actor.userName:'.root' and
(actor.process:'dnf'or actor.process:'/span>yum'
or actor.process:'rpm' or
actor.process:'python' or
actor.process:'update-alternatives')
System updates on SUSE Linux-based systems No Change actor.userName:`root` and (actor.process:`zypper` or actor.process:`rpm` or actor.process:`python` or actor.process:`update-alternatives`) actor.userName:'root' and
(actor.process:'zypper' or actor.process:'rpm' or actor.process:'python' or actor.process:'update-alternatives')
Windows updates and upgrades No Change (actor.process:`svchost.exe` or actor.process:`wuauclt.exe` or actor.process:`TiWorker.exe` or actor.process:`msiexec.exe` or actor.process:`WindowsUpdateBox.exe` or actor.process:`Setup.exe` or actor.process:`wusa.exe`) and (actor.userName:`NT AUTHORITY
SYSTEM` or actor.userName:`Administrator`)
(actor.process:'svchost.exe' or actor.process:'wuauclt.exe' or actor.process:'TiWorker.exe' or actor.process:'msiexec.exe' or actor.process:'WindowsUpdateBox.exe' or actor.process:'Setup.exe' or actor.process:'wusa.exe') and (actor.userName:'NT AUTHORITY' or actor.userName:'admin')

Introduced Quarterly Report Scheduling

With this release, we have introduced a new option to generate the quarterly report. You can now schedule your reports to run quarterly, providing you with greater flexibility in your reporting strategy. 

You can select the Quarterly option to generate reports that run on the first day of the next quarter. Previously, users had scheduling options for daily, weekly, monthly, or yearly. The addition of the Quarterly option enhances scheduling capabilities.

Benefits
  • Improved Time Management

    Scheduling reports quarterly allows users to allocate time more efficiently and reduces the frequency of report generation compared to daily or weekly schedules

  • Enhanced Data Analysis

    Quarterly reports can provide a clearer picture of performance trends and business cycles, facilitating better strategic decision-making based on comprehensive data analysis.

schedule Quarterly report.

Introduced Weekly Job for Creating Incidents

With this release, we have introduced a new option to create incidents weekly. You can automate the incident creation based on a QQL rule query defined in a Correlation rule. The schedule indicates when and how often you want to run the rule. By default, the rule is set to run once. You can also schedule the frequency of running this rule. Earlier this option was limited to daily, monthly, or repeat on specific days. Now, you can schedule your rule to run weekly. 

Benefits
  • Increased Flexibility

    The new weekly scheduling option allows users to tailor incident creation to their specific needs rather than being confined to daily or monthly schedules.

  • Efficient Incident Management

    Automating incident creation on a weekly basis helps organizations respond to issues in a timely manner, ensuring that critical incidents are not overlooked

For weekly recurrence, you can customize the frequency to run once a week. This means the rule runs weekly on the designated day.

Weekly Job for Creating Incidents.

Updated Download limit of Event Count CSV Report

With this release, we have enhanced the Event Count CSV report functionality.  The upper limit for exporting records has been increased to 500k. You can now export up to 500k records in a single CSV report. 

Update in Data Retention Policy

To comply with data retention policies and regulations, we have restricted access to the events for up to 15 months. You have access to events up to 15 months old. With the upcoming release, retrieval of data older than 15 months will no longer be possible.

For example, even if you use the DateTime picker for the last three years to get the events, the Events list includes data only from the last 15 months.

New Token for Events Tab

Token Description Example

actor.user.impersonated

Use the token value as true to filter events generated by impersonated users.

actor.user.impersonated: true

API Enhancements

With this release, we have updated Data Retention Policy and extended our support for OAuth 2.0 and OpenID Connect Authentication Standards. For more information, refer to API Release Notes.

Issues Addressed

Category/Component Issue
Incidents

We fixed issues by making relevant code changes:

  • The user had incident review access, but there was no option available to start the incident review.
  • Incident event mapping was incomplete, yet the status incorrectly indicated that it was completed.

Reports

We fixed an issue where Windows Weekly Report and the PCI DSS weekly report despite both being generated using the same monitoring profile and report template settings. The statistics in the Windows Weekly Report do not match those of the PCI DSS weekly report, and the user did not find any options available for modification.

Enhanced User Interface (UI 4.0) of the Qualys Cloud Platform

Introducing the new and improved UI with the following key upgrades:

Enhanced Navigation for a Streamlined User Experience 
Refreshed Dashboard
Standardized UI Elements for Seamless Navigation 
Reorganized the Communication Tab for Easier Information Management 

See it in Action 

Watch this video to explore the new UI and discover the key enhancements designed to improve your experience! 

Enhanced Navigation for a Streamlined User Experience 

The redesigned menu structure and streamlined layouts make it easier to access critical features. You can now navigate the platform more intuitively, reducing the time spent on routine tasks. The new layout reduces cognitive load, providing a more apparent distinction between primary, secondary, and tertiary navigation elements, ensuring a seamless workflow for new and experienced users. 

Primary and Secondary Navigation Elements 
Navigation Elements Updates
Primary We have added a vertical navigation bar on the left side of your screen for quick module access. This keeps your workspace organized and everything just a click away.
You can hover over this bar to view or hide icon labels as needed.

 Secondary The secondary navigation bar has been redesigned for a more intuitive user experience. Sub-menu options are displayed in a horizontal bar at the top, allowing easy access to features. Active tabs are highlighted in bold, making your current selection clear. 

 

Refreshed Dashboard

We have improved our dashboards for better accessibility, color scheme, typography, and data interpretation. 

These updates ensure easy information consumption for all users.


 

Standardized UI Elements for Seamless Navigation

We have applied a consistent look and feel across all modules, promoting better usability and reducing the learning curve. These updates ensure that transitioning between modules is seamless and intuitive.  

For example, here’s our redesigned Select Tags window with improved UI components.

 

Reorganized the Communication Tab for Easier Information Management

The Communication tab has been reorganized for better usability, with clear sections to help you quickly find important information. 

Section Updates
Notifications This section focuses on items requiring immediate attention and follow-up.

Messages  This section delivers general updates and information from the platform.

 

Enhanced UI Rollout Starting January 2025

The enhanced user interface is rolling out in phases starting January 2025. To guide you through the transition, you will receive in-platform notifications and email updates. Compatibility is seamless, with no additional setup required.  

Learn More 

Explore the full details of these updates! Check out our blog for insights.  

For more information on the rollout phase, refer to the Frequently Asked Questions

Platform Name Change Update

We are renaming the Qualys Cloud Platform to the Qualys Enterprise TruRisk Platform. This change highlights Qualys' commitment to empowering CISOs, cybersecurity professionals, and risk stakeholders to effectively measure and mitigate the impact of cyber risk on their organizations.

The Qualys Enterprise TruRisk Platform is the only cybersecurity and risk management solution that enables you to measure, communicate, and eliminate cyber risk across the extended enterprise with precise remediation and mitigation actions.

This update does not affect the platform’s functionality or features. The name change will be implemented across all product interfaces in phases, starting January 2025.

For more information, check out this blog.