TotalCloud Release 2.20

December 03, 2025

TotalCloud 2.20 brings updates to search tokens for insights, inventory, investigate, controls, and others.

Implementation of QQL Token Standardization

Applicable for: 

We have now implemented Qualys Query Language (QQL) token standardization across all Qualys applications. As part of this enhancement, both common and TotalCloud-specific tokens are updated with new token names that follow a standard, consistent nomenclature. 

The new token format follows the syntax provider.entity. attribute. For example, in the new token, aws.account.status, AWS is the provider, account is the entity, and status is the attribute.

Key Enhancements:

• Standardized Token Naming: The tokens, such as insights, inventory, investigate, and controls, now adhere to a standardized naming convention. The tokens common to all Qualys applications have also been updated.
• Search Bar Updates: Only the new tokens are displayed in the auto-suggestion in the search bars within the UI. However, if you type the old token name manually, the QQL query still works. The old tokens will not be visible in the auto-suggestions on the UI.
• Backward Compatibility: The existing Dashboard widgets and Saved Search Queries will continue to support the old tokens in edit mode.
• Improved Interoperability: The standardized tokens make it easier to copy and reuse the search query from one application to another, eliminating the need to remember multiple token names for different applications and similar searches.

For the complete list of old and new token mappings, see TotalCloud online help.

Enhanced IP Address Classification for EC2 Instance Resources

Applicable for: 

In the previous release, we had added support for AWS resources scanning and asset discovery with IPv6 addresses. With this release, we are enhancing the IP address classification and activation logic within the cloud asset discovery and ingestion flow. These enhancements ensure more accurate identification and representation of public and private IP addresses, especially for IPv6.

Key Features:

• The asset discovery mechanism now captures both IPv4 and IPv6 data.
• It now includes public and private IPs for both protocols.
• All network interfaces of cloud instances are scanned during asset discovery.

You can view detailed IP information (public/private, IPv4/IPv6) for each instance directly within the network section of the asset inventory details.

Event-Driven Connector Processing (Beta)

Applicable for: 

With this release, we have introduced event-driven connector processing (Beta). Connectors continue to run on their normal schedule, but instead of doing full scans, they now limit AWS API calls to only those resource types with detected changes. This reduces unnecessary full scans and improves performance.

Key Features

• When a change is detected for a resource type, the next connector run only fetches inventory for that specific resource type in the affected region (example, an S3 change in us-east triggers a full S3 inventory fetch in us-east).
• A full inventory sweep runs every 48 hours regardless of event mode.
• Exceptions (resource-level, connector-level, tag-based) are evaluated in real time for EventBridge-enabled users.
• Deleted Resource Visibility:
  • EventBridge-enabled users can use the token deletedFromCloud:true/false to view the deleted resources in the Inventory and Posture page.

    This token does not appear in autosuggestions and must be entered manually.

    
  • The deletedFromCloud field is also included in the CSV Assessment report.
    
    

Implementation Mechanisms

You can enable one or both of these implementation mechanisms for any of your connectors based on your needs.

• Only the deleted resources are detected in your cloud account and displayed in the TC application.
• An automatic event run where all the detected modified resources are processed from your cloud account.

Benefits

• Reduces AWS API calls and processing overhead
• Enables near real-time exception evaluation

• Manual runs always perform a full inventory scan.
• This feature is applicable for Global accounts (not U.S./China).

Reach out to your TAM (Technical Account Manager) to activate this feature for any connector or cloud type. When requested, they will supply a CloudFormation Template (CFT). You need to deploy this CFT in your AWS account to enable event-driven processing.

IaC Security: Enhanced SARIF Output for GitHub Integration

Applicable for: 

With this release, we have improved the SARIF output for IaC scans to ensure better compatibility with GitHub Actions and other SARIF-compliant tools.

Key Features:

• Accurate Severity Levels: Findings now display the correct criticality (High, Medium, Low) instead of showing all issues as “Error.” This helps you prioritize risks more effectively.
• Standards-Compliant URIs: URIs in the SARIF file now follow SARIF v2.0 specifications by removing the leading slash (/). This change ensures proper parsing and alignment with GitHub and other SARIF-compliant tools.

These improvements provide accurate severity reporting and fully standards-compliant output, enabling smoother integration with GitHub Code Scanning Alerts and reducing workflow errors.

Cloud Detection and Response (CDR)

The following sections describe the enhancements made to the CDR environment in the upcoming CDR release. 

These CDR enhancements will be available by the end of November.

Enhanced CSV Reports: MITRE Information Added

Applicable for:     

We have enhanced the CSV reports generated via the UI to include MITRE-related fields, MITRE TACTICS and MITRE TECHNIQUES. The MITRE_TECHNIQUES column also contains the corresponding MITRE rule ID.
This enhancement helps align findings with the MITRE ATT&CK framework and makes it easier to understand which tactics and techniques are involved.

Control Updates

Updated Policy Versions

Applicable for:   

We have updated the following policies to their latest CIS versions.

Policy	CIS Version
CIS Azure Foundation Benchmark	Version 4.0.0
CIS GCP Foundation Benchmark	Version 4.0.0
CIS OCI Foundation Benchmark	Version 3.0.0

Run Time and Build Time Controls Deprecated

Applicable for: 

Azure Controls Policy-To-Policy Migration

Applicable for: 

Existing Controls Removed from CIS Microsoft Azure Foundations Benchmark policy

Applicable for: 

Control Title Changes

Applicable for:  

Issues Addressed

The following issues reported by customers, as well as other notable problems, have been resolved in this release.