Configure the Extension for Build Pipelines Projects

The Qualys IaC Security extension can be added as a task in your Build pipeline.

You can use the Qualys IaC Security extension as a pre-deployment task in your project pipeline. After installing, you can see the Qualys IaC Security extension as a task in your pipeline.

Perform the following steps in the task tab:

1. Click   the icon under your agent job and search for Scan IaC templates using Qualys Qualys TotalCloud. Click Add to add the extension as a task in the build pipeline.

   

2. Click the task under the agent job to configure the extension.

   

3. After entering the display name, you must provide the IaC scan service endpoint to connect to Qualys TotalCloud APIs. You can use the preconfigured IaC scan service endpoint or configure a new one.

4. Click New to the IaC Scan service/server endpoint field to configure a new service endpoint.

   

5. Provide the repository details and authentication information.

   To create a user-level client, see Set up Token-based Authentication from UI.

   1. In the Authentication Type field, specify one of the following options:

      Basic

      OAuth

      Identity Provider (IDP)

      The fields displayed below depend on the selected authentication type.

      Basic Authentication 

      Enter Basic Authentication Details (If Selected)

      Provide the following details:
      • Username – Enter the Qualys username.
      • Password – Enter the corresponding password.

      OAuth Authentication 

      Provide the following details:

      • Client ID – Enter the OAuth client ID.
      • Client Secret – Enter the OAuth client secret.

      Identity Provider (IDP) Authentication

      Use Identity Provider (IDP) authentication to connect through your organization's external Identity Provider. When you select IDP, the client ID and client secret must be the ones generated in your Identity Provider, not in Qualys. For more details, see API Authentication using IdP Provider Tokens.

      Provide the following details:

      • Username/Client ID – Enter the client ID configured in your Identity Provider.
      • Password/Client Secret – Enter the client secret configured in your Identity Provider.
      • Authentication Type – Enter IDP.
      • Token URL – Enter the URL of your Identity Provider token endpoint. The extension sends an authentication request to this endpoint to obtain an access token. This field is mandatory for IDP authentication.
      • Scope – (Optional) Enter the scope to request from your Identity Provider, if your IDP configuration requires it.
      • Audience – (Optional) Enter the audience value configured for your Identity Provider. This value must match the audience configured in Qualys.

      

      Before you use IDP authentication, contact Qualys Support to configure your Qualys environment for your Identity Provider. Authentication requests fail until this setup is complete.

6. Provide a Service connection name and click Save.
   Once added, the service endpoint is listed in the IaC Scan service or server endpoint drop-down field.

   The Qualys platform URL that you use here depends on the Qualys platform your organization is using. To identify the platform URL, refer to Identify your Qualys platform.

If your Azure DevOps instance does not have direct Internet access and requires a proxy, click Use Proxy check box, and enter the proxy server information.

Launch Scan API Parameters

In the Launch Scan API Parameters, provide a scan name, file path, or directory you want to scan.

The Scan Name is populated automatically. By default, the scan name is $(DefinitionName)_azureDevOps_$(ID). However, you can update the scan name.

Enter the file name or directory path to be scanned. If you do not specify the path, the entire repository is scanned.

 By default,.tf, .yaml,.yml, .json, and .template files in the directory are scanned. If you want to scan any compressed file, add the path and name of the compressed file. For example, .zip, .7z, .tar, .tar.gz, and .gz.

Build Failure Conditions

Configure the criteria to fail a build job based on the number of failed controls for each severity.

The build fails if the number of failed controls exceeds the specified number for one or more severity types in scan results.

Timeout Settings

In the Timeout settings, specify the polling frequency in seconds for collecting the IaC scan result data. By default, it is set to 30 seconds.

We recommend you set this value to a minimum of 10 seconds.

You can also specify the timeout duration for a running scan. By default, it is set to 10 minutes.

Save the configuration and click Queue to run the pipeline.

Next Step

Qualys IaC Scan Result