TotalCloud Release 2.23

March 27, 2026

TotalCloud 2.23 release aims to enhance the accuracy and clarity of cloud inventory, posture, and resource identification across providers, making it easier for you to track changes and identify issues. It also adds scheduling for automated reports and improves CDR event visibility with more detailed summaries and MITRE mappings.

AWS AI Service Inventory Coverage Updates

Applicable for:   

In this release, we are removing the Bedrock Foundation Model resource type from our AWS AI Services inventory to eliminate confusion caused by the visibility of out-of-the-box AI models.

The inventory continues to identify and report the following AI service resources:

• Bedrock Custom Models
• Bedrock Knowledge Bases
• SageMaker Models

 All previously introduced API parameters and tokens for AI Service inventory access remain unchanged and continue to function as expected.

Inventory for IaC via GitHub Apps

Applicable for: 

With this release, we are introducing a new Qualys IaC scan integration with GitHub Actions that provides enhanced visibility and traceability into your Infrastructure-as-Code (IaC) repositories. This allows you to easily track who made changes to files, identify misconfigurations faster, and maintain a centralized, consolidated inventory across all repositories.

To support this, we are introducing a dedicated “Code” inventory page that offers a comprehensive view of all IaC files scanned via the GitHub Actions connector. The page displays details such as the file name, file type, last updated time, and the last committed user.

The inventory supports the following IaC file types and extensions: tf, zip, json, tar, gz, 7z, yaml, yml, template.

Selecting any file opens a new window to give more details about the file, such as:

• Summary: This page displays details of the file, such as file path and git repository details, including repository name, branch, and source

• Controls Evaluated: This page displays the controls used to evaluate the selected file. It includes the result for each control (Pass or Fail) and its associated criticality level.

 The Code tab is available only to users with an active paid or trial TotalCloud subscription. It is not available in the free version.

Report Scheduling and Notifications

Applicable for: 

With this release, You can now generate reports on demand or schedule to generate reports at a defined time. With the scheduling, you can define report generation frequency, receive email notifications when the reports are ready, and download the reports from the Reports tab.

Benefits

• Improved automation - Reduce manual effort by scheduling recurring reports.
• Better visibility - Track report generation status with clear job states.
• Faster distribution - Automatically deliver reports via email upon completion.
• Flexible configuration - Control timing, frequency, recipients, and formats.
• Scalable management - Easily manage multiple scheduled reports from a single view.

Key Features

• Run or Schedule Reports: Run a report immediately or schedule it to run automatically. Configure recurring schedules (daily or weekly), select specific days, and set schedule end conditions (end on a date or after a number of occurrences).
• Email Notifications: Send completion notifications to one or more recipients.
• Schedule Management: Run, pause, resume, or delete scheduled reports from the list page. You can also perform bulk actions on multiple schedules (up to supported limits) and download the reports once they are generated.

Scheduled reports can be paused, resumed, or updated at any time.

 You can delete up to 10 scheduled reports at a time.

 When creating a schedule, make sure the report generation time is set at least three minutes after the schedule start time. If both times are the same, the report fails to download.

Azure Databricks Resource Identification Improvement

Applicable for:  

With this release, we have improved how Azure Databricks resources are identified and displayed in the Inventory. Azure Databricks workspaces provision virtual machines (VMs) to run compute clusters. Previously, these VMs were discovered and listed in the inventory as generic virtual machines, making it difficult to distinguish them from user-managed Azure VMs.

This release addresses the concern by skipping asset activation for Azure Databricks–managed VMs to prevent to avoid unwanted license usage. We also added improvements to make Databricks resources easier to identify, filter, and report on.

Key Features

• Two new columns, Publisher and Offer, are added to the Inventory > Cloud tab for Microsoft Azure instances for virtual machines. These columns display VM image metadata to quickly identify Databricks-managed compute resources.
• Two new search tokens are introduced to help you create queries and filters based on image metadata values to quickly isolate Databricks assets or any other image types.
  • azure.vm.imageOffer
  • azure.vm.imagePublisher
  Refer to the New Tokens section for details.

Inventory/Posture: Resource Discovery and Visibility Enhancements

Applicable for: 

Earlier in release 2.18.0, we introduced the ability to view deleted or terminated resources. In this release, we are adding visual indicators to help identify such resources directly from the resource list.

This enhancement helps identify stale, inactive, or deleted resources, helping you maintain an accurate view of your cloud environment.

With EventBridge enabled, deletion events are clearly displayed in the UI, providing better visibility into resource lifecycle changes.

Key Features

• Resources that have not been discovered/evaluated during the last 7 days are now marked with a visual indicator () in the Inventory and Posture views. This helps identify resources that may no longer be active or are no longer being scanned.
• Resources that are deleted or terminated are now marked with a deleted icon () in the Inventory and Posture view. This icon is available only when AWS EventBridge is enabled, as deletion events are captured through EventBridge.
• Two new tokens have been introduced to help filter and identify such resources:
  • cloud.resource.NotDiscoveredIn7Days – Available in Inventory to filter resources that have not been discovered in the last 7 days.
  • cloud.resource.NotEvaluatedIn7days – Available in the Posture tab to identify resources that have not been evaluated in the last 7 days.

CDR Enhancements and Updates

The following sections describe the enhancements made to the Cloud Detection and Response (CDR) environment in the upcoming CDR release.

Event-Type Based Summaries

Applicable for:   

CRS (Container Runtime Security) findings now present more detailed event-type-specific summaries. Instead of a single basic summary plus raw data, the details panel dynamically shows Process, Network, or File sections based on the event type.

Key Features

• CRS events are auto‑segregated into Process, Network, and File categories.
• The summary panel adapts to the category, revealing the most relevant attributes per event type.

MITRE ATT&CK Mapping Expansions

Applicable for:   

With this release, we have expanded MITRE ATT&CK visibility: the MITRE column now visible for CDR events, in addition to CRS. This includes flow logs, appliance, and guard duty data sources, enabling a uniform threat‑technique view across detections.

New “Group By” Options for CRS

Applicable for:   

With this release, we have added more “Group By” options for CRS-related findings under the Qualys Locator Path (QLP) category, which improves how findings are organized and reviewed.

Benefits

• Accelerated discovery: More detailed grouping helps uncover findings that might be overlooked in the standard list view.
• Noise reduction: Reduces the number of results by grouping related findings and helps in focused analysis.

With Findings Type set to All, two QLP grouping options are available: Cluster QLP, and Container QLP.

With Findings Type set to Container, five QLP grouping options are available: Account QLP, Cluster QLP, Namespace QLP, Pod QLP, and Container QLP.

Five new tokens have been introduced to help you filter and identify findings under the QLP category.

• container.instance.account.qlp
• container.instance.namespace.qlp
• container.instance.pod.qlp
• container.instance.cluster.qlp
• container.instance.qlp

Refer to the New Tokens section for details.

To learn more about the Container QLP structure, refer to Container Security 1.42 release notes.

New Tokens

The following section describes the new tokens introduced as part of TotalCloud 2.23.0

Common Tokens

Applicable for: 

Inventory Tokens

Applicable for:   

The following section describes the new tokens introduced for Azure Inventory as part of TotalCloud 2.23.0

Resource Type	Name	Description	Example
Virtual Machine	azure.vm.imageOffer	Use this token to filter VMs by Azure image offer name.	azure.vm.imageOffer: Databricks
Virtual Machine	azure.vm.imagePublisher	Use this token to filter VMs by Azure publisher name.	azure.vm.imagePublisher: AzureDatabricks

Control Updates

New IAC Build Time Controls in AWS

Applicable for:   

New controls for Azure Without Policy Attachment

Applicable for: 

New controls in GCP Kubernetes Engine Best Practices Policy

Applicable for: 

New Controls in OCI without Policy

Applicable for: 

New Controls in Oracle Infrastructure Foundation Benchmark:

Applicable for: 

Control Title Changes

Applicable for:   

Control Enhancements

Applicable for:   

Controls Deprecated

Applicable for:   

Issues Addressed

Applicable for: 

The following issues reported by customers, as well as other notable problems, have been resolved in this release.