Securing Azure with Qualys

Welcome to Qualys Enterprise TruRisk™ Platform and security scanning!

This guide discusses securing your assets in Microsoft Azure infrastructure using Qualys. Using this guide you can get acquainted help with Qualys solutions for securing your Cloud and traditional IT infrastructure.

Qualys Integrated Security Platform

Qualys Enterprise TruRisk™ Platform gives you a real-time view of your security and compliance. If you are new to Qualys, we recommend you visit the Qualys Enterprise TruRisk™ Platform web page to learn more about our cloud platform. cloud_platform_apps

Azure Cloud Terminologies

Microsoft Azure - The Microsoft cloud platform, a growing collection of integrated services including Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offerings. For more details, refer to the Azure documentation.

Azure Resource Manager - Azure Resource Manager enables you to work with the resources in your infrastructure solution as a group. You can deploy, update, or delete all the resources for your solution in a single, coordinated operation. You use a template for deployment and that template can work for different environments such as testing, staging, and production. For more details, refer to the Azure documentation.

Resource Group - A container that holds related resources for an Azure solution. The resource group can include all the resources for the solution, or only those resources that you want to manage as a group. You decide how you want to allocate resources to resource groups based on what makes the most sense for your organization. For more details, refer to Azure documentation.

Resource Manager Template - A JavaScript Object Notation (JSON) file that defines one or more resources to deploy to a resource group. It also defines the dependencies between the deployed resources. The template can be used to deploy the resources consistently and repeatedly. For more details, refer to the Azure documentation.

Microsoft Azure Cloud Computing Terms - Microsoft Azure portal has a dictionary of common cloud computing terms relevant to their cloud based services. This is especially useful if you are new to Microsoft Azure. For more details, refer to the Azure documentation.

Securing Azure Essentials - IaaS and PaaS

Qualys integrates with Microsoft Azure Resource Manager (ARM) to discover assets using a Microsoft Azure Resource Manager (ARM) API. This integration automatically detects and synchronizes changes to virtual machine instance inventories within Azure Cloud Platform. Virtual machines are tracked by virtual machine Id within Qualys even as their IP addresses change over time.

Securing Azure Essentials - IaaS, PaaS, and Infrastructure

Qualys integrates with Microsoft Azure Manager (ARM) to discover assets using a Microsoft ARM API integration. This integration automatically detects and synchronizes changes to virtual machine instance inventories within Azure Cloud Platform. Instances are tracked by instance ID within Qualys even as their IP addresses change over time.

Prerequisites

Qualys Applications: Vulnerability Management (VM), Policy Compliance (PC) or Security Configuration Assessment (SCA), Cloud Agent (CA).
Qualys Sensors: Virtual Scanner Appliances, Cloud Agents, as desired.
Qualys Virtual Scanner Appliance virtual machine must be able to reach the Qualys Enterprise TruRisk™ Platform over HTTPS port 443.
Scanner personalization code (14 digits) used to deploy Virtual Scanner Appliance: This is obtained from your Qualys account as described in this Add New Virtual Scanner in Qualys.
Qualys user account: Must have a Manager or Unit Manager role.

Get Started

You might already know Qualys Cloud Suite, features, and user interface.

Quick Steps: Securing Azure

Here is the user flow for securing Azure using Qualys.

workflow

Additional Resources

If you are new to Qualys, we recommend these overview tutorials - it just takes a few minutes.

Here are the links to video libraries:

Here are the links for some helpful resources:

Qualys Training | Free self-paced classes, video series, and online classes
Qualys Documentation | Getting started guides, quick references, API docs
Qualys Community | Learn from the Project Managers, Subject Matter Experts, and other Qualys customers
Qualys Blog | Get the latest updates and Helpful hints