Manage Assets Using Qualys
Here are some best practices and tips for organizing assets to help you secure Azure infrastructure using Qualys.
Setting up Qualys Configurations
Asset Groups
Organize assets into meaningful groups and assign them to sub-users. Asset groups are required when you have multiple users i.e. Scanner, Reader, Unit Manager (if business units are defined). The same IP address can be included in multiple asset groups.
Business Units
Organize users and assets into business units to match your organization. This allows Managers to grant users role-based permissions in the context of their assigned business unit. The same IP address can be included in multiple business units.
Networks
Organize discrete private IP networks to keep overlapping IP blocks separate. When configured Qualys tracks IPs by network and IP address. Keep in mind... An IP address must be unique to your subscription or a single network.
Removing Terminated Virtual Machines:
You can remove terminated virtual machines from your Qualys account using following steps:
- Go to VM/VMDR or Policy Compliance > Assets > Asset Search.
- Select the assets with the tracking method as an IP address.
- Add more parameters to refine your, such as Last Scan Data not within x days and so on.
-
Click Search and then select the assets from the results.
-
From the Actions drop-down, select Purge. This results in the removal of assets along with their associated data from the module.
Uninstall agents
Consider a scenario where you have deployed cloud agents on your Azure assets and you want to uninstall agents not checked-in for last N days, you can use the API call.
Request
curl -u "USERNAME:PASSWORD" -X "POST" -H "Content-Type: text/xml" -H
"Cache-Control: no-cache" --data-binary
@uninstall_agents_not_checkedin.xml
"https://qualysapi.qualys.com/qps/rest/2.0/uninstall/am/asset/"
Contents of uninstall_agents_not_checkedin.xml:
<?xml version="1.0" encoding="UTF-8" ?>
<ServiceRequest>
<filters>
<Criteria field="tagName" operator="EQUALS">Cloud Agent</Criteria>
<Criteria field="updated" operator="LESSER">2016-08-
25T00:00:01Z</Criteria>
</filters>
</ServiceRequest>
For more information on Cloud Agent APIs, refer to our Cloud Agent API User Guide.