Deploying Qualys Scanner Using CLI

You can deploy Qualys Virtual Scanner Appliances using the Azure CLI. Once deployed, the scanner functions as a standard Virtual Scanner and can scan based on an IP address or CIDR block.

Want to learn more about Microsoft Azure? Click the Azure Support page.

Quick Steps

• Basic Settings in Azure
  • Create Resource Group 
  • Create Storage Account 
  • Create Storage Container
  • Create Virtual Network
  • Copying Qualys image into your Storage Account\
• Scanner Configuration in Azure using CLI

Deploy Qualys Scanner via CLI Using SAAS URI Image

This section describes how to deploy and configure the Qualys Virtual Scanner Appliance using Azure CLI commands.

Prerequisites

To deploy Qualys scanner via CLI using the SAAS URI image shared with you by Qualys, the following are prerequisites:

• Qualys custom image already created in your Azure subscription, see section 'Using Azure GUI to Create Qualys Image and Deploy Scanner'.
• Access to running Azure CLI either launched from Azure Cloud Shell in Azure portal or your local installation of Azure CLI
• 14-digit PERSCODE obtained from Qualys

To deploy Qualys scanner via CLI using SaaS image, perform the following steps:

1. Prepare userdata.txt file with mandatory PERSCODE and optional PROXY_URL:

   Example of userdata.txt:

   PERSCODE=70612345678901

   PROXY_URL=user:pass@proxyhost:443

2. Run the CLI command to create the VM scanner:

   CLI command to create VM scanner

   az vm create \
     --name <vm name> \
     --resource-group <name of resource_group> \
     --image "<image id>" \
     --size <vm size> \
     --authentication-type password \
     --admin-username azureuser \
     --admin-password "PasswordNotUsed123!" \
     --public-ip-address "" \
     --subnet "<subnet id>" \
     --boot-diagnostics-storage <name of storage_account> \
     --user-data @<path to userdata file>      
   

Azure requires admin-username and admin-password or ssh-key to create a VM but qVSA will not enable user login.
Enabling boot diagnostics is highly recommended for troubleshooting purposes.

Example

az vm create \
  --name qualys-scanner \
  --resource-group myRG \
  --image "/subscriptions/abcd6da1-7e18-4eb9-9c0a-9bcb465f4e20/resourceGroups/myRG/providers/Microsoft.Compute/images/qVSA-Azure.x86_64-4.2.16-2" \
  --size Standard_F4s_v2 \
  --authentication-type password \
  --admin-username azureuser \
  --admin-password "PasswordNotUsed123!" \
  --public-ip-address "" \
  --subnet "/subscriptions/abcd6da1-7e18-4eb9-9c0a-9bcb465f4e20/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/ScannerGrp-VN_10.95.4.0-22/subnets/my-Net" \
  --boot-diagnostics-storage myStorageAccount \
  --user-data @userdata.txt