Prerequisites

To assess your scanner inventory and run replacements, you need:

• Qualys API credentials (username and password) with API access enabled.
• Docker Engine 20.10+ and Docker Compose v2.
• Network access from the host running the toolkit to your Qualys API endpoint (outbound HTTPS/443).
• A Docker host running on x86_64 (amd64). The toolkit image is not built for ARM.
• A Qualys user with the Manager or Unit Manager role. The Replace Scanner Appliance API, which the toolkit uses, requires one of these roles.

Terraform is included in the toolkit's Docker image, so no separate installation is required if you plan to use automatic VM deployment.

VMware vSphere Auto-Deploy

To have the toolkit deploy replacement scanner VMs on VMware vSphere automatically, you also need:

• A vCenter Server with credentials (username and password).
• The network names, datastore, cluster, and host information for the target environment.
• The qVSA OVA file, either mounted locally, available at a downloadable URL, or already imported as an item in a vSphere Content Library.
• The vCenter Server's TLS certificate. It must be trusted by the host running the toolkit (public or company CA), or, for a self-signed certificate or a VMware CA (VMCA), you can trust it from the toolkit. See vCenter certificate in Auto-Deploy: VMware vSphere.

AWS Auto-Deploy

To have the toolkit deploy replacement scanner instances on AWS automatically, you also need:

• An AWS account with permissions to create EC2 instances, security groups, and to access AMIs.
• An AWS access key ID and secret access key.
• An existing subnet ID and, optionally, a security group ID.
• A subscription to the Qualys Virtual Scanner Appliance on AWS Marketplace, if you plan to use marketplace AMI auto-discovery.

See Installation to set up the toolkit.