Integrate Cloud Detection and Response (CDR)
By integrating CDR with Azure Blob Storage, you can get near real-time, up-to-date visibility of your threat posture and suspicious network activity in the Azure Blob Storage console. These findings, gained by correlating Qualys information with other data in Azure Blob Storage, allow you to take rapid, remedial actions.
Prerequisites
The following are the prerequisites to integrate the Qualys Cloud Detection and Response application with Azure Storage Blob:
- You must have a storage account with the necessary permissions.
- The CIPS service must be enabled for your subscription. Qualys Support enables it for your account. Contact the Qualys Support team for the integration process.
- Qualys applications: You must have enabled Cloud Detection and Response (CDR) and Cloud Agent (CA) for your subscription.
- Permissions: The API Access permission must be enabled for your account.
- Role: You must have the Manager or Unit Manager role.
- Platform version: You must be on Qualys Enterprise TruRisk™ Platform version QWEB-10.21.1.0 or later.
Onboarding APIs
The Qualys Support helps you integrate Azure Storage Blob with the Qualys Could Platform.
If you do not have a CDR product created for your subscription, you can start by calling the product APIs. If you already have a CDR product running, you can start with Azure Storage Blob Integration APIs.
CDR Product APIs
The following APIs are used for creating and managing the CDR product:
|
API |
URL |
Operator |
Description |
|---|---|---|---|
|
<qualys_gateway_url>/partner- integration/product |
POST |
Creates a new CDR product. |
|
|
<qualys_gateway_url>/partner- integration/product/CDR |
GET |
Gets the details of the created CDR product. |
|
|
<qualys_gateway_url>/partner- integration/product/CDR |
DELETE |
Delete the CDR product. |
CDR Integration APIs
The following APIs are used for integration the CDR product with Azure Storage Blob:
| API | URL | Operator | Description |
|---|---|---|---|
| Create Integration | <qualys_gateway_url>/partner-integration/<cipsProductId>/integration | POST | Creates a new integration with Azure Storage Blob |
| <qualys_gateway_url>/partner-integration/<cipsProductId>/integration | PUT | Update the integration with Azure Storage Blob | |
| <qualys_gateway_url>/partner-integration/<cipsProductId>/integration | GET | Get details of the integration with Azure Storage Blob | |
| <qualys_gateway_url>/partner-integration/<cipsProductId>/integration | PATCH | Validate the integration with Azure Storage Blob | |
| <qualys_gateway_url>/partner-integration/<cipsProductId>/integration | DELETE | Delete the integration with Azure Storage Blob |