TotalCloud Release 2.27

August 21, 2026

Qualys TotalCloud 2.27.0 introduces tag and permission-based access control for Policies, Controls, and Exceptions. This release also extends event-driven connector processing to Azure via EventGrid, surfaces Attack Path insights directly at the instance level, and adds wildcard tag search, one-click policy cloning, and a searchable query Function Catalog. Cloud inventory coverage expands with 40 new resource types across AWS, Azure, GCP, and OCI.

Granular Access Control for Policies and Controls

Applicable for:   

TotalCloud now supports granular, action-level permissions (view / create-clone / edit / delete) for Policy, Control, and Exception management, as well as tag-based scope, which extends scoping to Policies and Controls. Today, scope is derived from connectors only; going forward, you can choose to derive scope from connectors only (connector-based scope) or from connectors + policy (connectors + policy-based scope).

Benefit

Sub-users can be shown only the Policies and Controls relevant to their area of work, instead of the full set. Evaluations are filtered to the same scope, so a sub-user's view stays consistent across Posture, Exceptions, and Evaluations.

Prerequisites

To scope the posture visibility based on policy scope, a Manager user must select the new mode on the Preferences tab (visible only to Manager users). If you don't opt in, you see no change in behavior.

Key Features

• New granular permissions, replacing the legacy Manage Custom Control permission
• 2 new predefined roles: TotalCloud Policy Admin and TotalCloud Policy Reader
• Tag-based scoping for Policy and Control visibility, including a GLB_POLICY_READ tag for read-only sharing with sub-users
• Interface updates across Posture, Policy, Response, Reports, Inventory, Attack Path, and Investigate, based on the permissions a role holds

Navigate to Configure > Preferences, and then select Connector + Policy Scope under Scope Management to control access using connectors, policy, and control tags together.

For scope modes, the GLB_POLICY_READ tag, scoped vs. unscoped user behavior, and the override options, see the Tag-based Scope on Policy, Control and Exceptions help page.

Event-Driven Connector processing via Azure EventGrid

Applicable for: 

You can now use Azure EventGrid to enable event-driven processing for Azure cloud connectors. Like AWS EventBridge, Azure EventGrid processes only the resources affected by detected changes, rather than performing full scans for every connector run, reducing unnecessary API calls and improving processing efficiency.

Key Features

• Supports event-driven processing for standalone Azure Cloud Connectors configured with the Global Subscription type.
• Detects and processes only changed resources while continuing scheduled connector runs.
• Performs periodic full inventory scans to ensure inventory consistency.
• Provides real-time exception handling and resource deletion processing.

Deleted Resource Visibility

• EventGrid-enabled users can use the token cloud.resource.isDeleted:true/false to view deleted Azure resources.

Benefits

• Reduces Azure API calls and connector processing overhead.
• Helps keep Inventory and Posture data synchronized with changes in your Azure environment.

Attack Path Visibility at the Instance Level

Applicable for:   

TotalCloud now surfaces Attack Path insights directly at the instance level, so you no longer need to leave the instance view to understand a resource's risk exposure. Previously, attack paths were visible only on the Insights tab, with no way to search or filter for them elsewhere. With this release, VMs and other assets across AWS, Azure, and GCP display attack path context directly on the instance listing page.

Benefits:

• See risk at a glance: An Insights count is now displayed directly on the TotalCloud Instances Listing Page.
  
• One-click drill-down: Clicking the Insights count navigates directly to the Insights tab, pre-filtered for that instance.
  

Wildcard (*) Support for Tag-Based Search

Applicable for: 

You can now use the wildcard character (*) in tag searches to match tags by pattern rather than exact text across the Posture, Inventory, and Connectors pages, as well as other pages that support tag-based search.

Supported patterns:

Pattern	Example	Matches	Examples
Starts with	tags:"prod_*"	Any tag beginning with "prod_*"	prod_1 or prod_new
Ends with	tags:"*_legacy"	Any tag ending with "_legacy"	10_legacy or new_legacy
Contains	tags:"*finance*"	Any tag containing "finance"	1_finance_x or newfinance1

This improves search flexibility for organizations using consistent tag naming conventions (prefixes, suffixes, or keywords) across accounts and environments.

Tag search is case-sensitive, the text you enter must match the case of the tag exactly. Only the wildcard (*) portion is flexible.

Copy and Create new Policy from an existing one

Applicable for: 

You can now create a new policy by copying an existing one, system-defined or user-defined, right from the Policy listing page.

Select Create Copy on any policy to carry its description, execution type, controls, and connectors into a new policy, then:

• Give the copy a new, unique name before saving.
• Add or remove controls to fit the new policy's purpose.
• Assign scope tags for the new policy.

Look up Query Functions

Applicable for: 

The Policy menu now includes a Function Catalog tab, providing direct in-product visibility into the functions used in custom investigation queries and controls.

Key Features

• New "Function Catalog" tab under Policy, alongside Policy, Controls, Mandates, and Exceptions. 
• Listing of 23 supported functions (Function + Type), across 9 categories: Date & Time, IP Address, Port, Set Algebra, AWS Cloud Account, AWS SNS, AWS VPC, AWS (Policy), and AWS S3.

Click a function to open a detail panel with Info and Logic tabs, a searchable JSON view of its type, description, and usage example, and node-path controls for the JSON. 

Extended Inventory Coverage

Applicable for:   

We have expanded our cloud security coverage by adding support for additional AWS, Azure, GCP and  OCI resource types in Cloud Inventory, enabling discovery, inventory, and security posture assessment across a broader range of cloud services. 

The resources are as follows:

Additionally, we have improved the following Azure resources to include more details:

• Event Hub Namespace: Added details for Diagnostic Settings.
• Storage Accounts: Included Blob Service Properties detail.

Navigate to Azure Cloud directly from Posture

Applicable for: 

You can now directly access impacted Azure resources from the Evidence Details section using View in Azure Console. This enhancement enables faster investigation and remediation of resources flagged during control evaluations.

Previously, you had to manually go to the Azure Console, and search the resource to get the details.

Now, you can navigate directly from Evidence details to the respective resource section in your Azure Console, when you select the option "View in Azure Console".

Date Range Filtering for All Inventory

Applicable for: 

You can now filter results on the All Inventory page by date range. This makes it easier to narrow your asset view to a specific time window, which is useful for investigating recently discovered or updated assets and for more targeted inventory analysis.

Key Features

• New date range selector added to the top of the All Inventory page (next to the search bar)
• Choose from preset ranges: Last 24 Hrs, Last 7 Days, Last 30 Days, Last 90 Days, This Month, Last Month
• Or select Specific Range to define a custom start and end date
• Filters the inventory list by Last Discovered date

Benefits

• Quickly focus on recently discovered assets (e.g., last 24 hrs) for real-time monitoring
• Use custom ranges for audits, investigations, or period-specific reporting
• Reduces manual scanning through the full resource list to find assets from a relevant time period

Smarter Inventory Filter Dropdown

Applicable for: 

On the Inventory page, the inventory type filter dropdown now lists the most commonly used resource types at the top of the list for each cloud provider. Previously, all resource types were listed together, making it harder to quickly locate the right one, given that naming conventions differ across providers. For example, an Instance in AWS is a Virtual Machine in Azure, a VM Instance in GCP, and a Compute Instance in OCI.

Benefits

• Faster Resource Selection: Frequently used resource types are pinned to the top of the dropdown, reducing time spent searching or scrolling.
• Consistent Experience Across Providers: Each cloud provider's most relevant resource types are surfaced using that provider's native naming conventions.

Navigate to TotalCloud > Inventory > Cloud > [Select Cloud Provider] > [Select any Inventory Type] and use the inventory type filter dropdown. The following resource types now appear at the top of the list for each provider:

View Overall Compliance Score in Assessment Report

Applicable for:   

We have added a new Overall Compliance Score field to CSPM assessment report CSV exports (AWS, Azure, GCP, and OCI). This score reflects resource-level compliance, using the same methodology as the dashboard and posture views, ensuring consistency across all reporting surfaces.

The new field is displayed near the top of the CSV, directly before the Account Level Statistics section.

Set a Default Time Period in Preferences

Applicable for:   

You can now set a default time period for TotalCloud pages directly from Configure > Preferences tab, so you no longer need to manually select your preferred time filter every time you visit a page.

A new option, Default Time Period Selector, is available on the Preferences tab. You can select one of the following as your default time filter:

• Last 24 Hours
• Last 7 Days (Default)
• Last 30 Days

This preference applies across the following TotalCloud pages: Inventory, Posture, Insights, Investigate, and Dashboard.

Simplified CSPM Connector Health Monitoring

Applicable for:

To simplify connector health monitoring, we have removed the Status column from the CSPM Connectors tab under TotalCloud > Configure > CSPM Connectors. This column is being deprecated to eliminate confusion between redundant status indicators and the more comprehensive, accurate information available in the Connectors Logs.

For the most reliable and detailed view of connector health and issues, we recommend using the Last Job Summary section for any Connector in the Connectors module going forward.

 Deprecation of the Status column does not influence connector functionality or data collection. This update is a UI cleanup to consolidate connector health monitoring into a single, authoritative location.

Resource Name Update in Inventory

Applicable for: 

The inventory type previously listed as "Gemini Enterprise Agent Platform" (associated service: "Vertex AI") has been renamed. It now is displayed as "Model Registry", with its associated service updated to "Gemini Enterprise Agent Platform". This change aligns the inventory naming with the current service structure and improves clarity for users browsing the inventory list.

CDR Enhancements and Updates

The following sections describe the enhancements made to the Cloud Detection and Response (CDR) environment in the upcoming CDR release.

Sensitive Data Detections

Applicable for:   

Investigate now features an added Sensitive Data tab, alongside Detections and Cloud Configuration. This tab highlights exposed secrets like access keys, credentials, tokens, and certificates found within your AWS EC2 instances, Azure VMs, GCP instances, and also detects secrets like embedded keys and credentials during container image scans, enabling you to identify and address these risks without leaving the Investigate workspace. 

Benefits

• One place for secret exposure risk: Cloud resources and container images are covered together, so nothing falls between the cracks.
• Faster triage: Severity, at-risk accounts and clusters, and a 7-day trend are summarized up front, so you know where to look first.
• Deeper detail on demand: Open any finding for full context, down to the raw detection payload, without losing your place in the list.
• Consistent experience: Sensitive Data employs the same layout, search, and filters as Detections, ensuring a consistent experience across tabs.

Enriched CDR Findings for On-Prem Assets

Cloud Detection and Response (CDR) enriches threat findings from on-prem appliances with real asset context, pulled directly from your CyberSecurity Asset Management (CSAM) inventory.

Previously, on-prem findings only listed assets by IP or MAC address (e.g., 10.XX.X.XX3). Now, if tracked in CSAM, findings also display the hostname, location, and tags (e.g., fin-db-03.internal, London, finance-prod), eliminating the need for manual lookups.

Select any on-prem finding to open the asset details page and view the hostname, location, and tags.

 Findings for assets not found in CSAM continue to show the IP or MAC address as before.

New Tokens

The following section describes the new tokens introduced as part of TotalCloud 2.27.0

Common Tokens

The following new tokens are introduced for Posture, Reporting, and Unified Dashboard.

Applicable for:   

Inventory Tokens

Applicable for: 

The following new tokens are added for Subnet resource type

Control Updates

New controls in CIS Microsoft Azure Compute Services Benchmark Policy

Applicable for:  

New Controls for Azure (Available for Policy Attachment)

Applicable for:  

Controls Migration

Applicable for:   

Controls Added To New Policies

Applicable for:   

Control Enhancements

Applicable for:  

Platform	CID	Title	Description
AWS	202	Ensure to update the Security Policy of the Network Load Balancer	We have updated the control logic, and updated the list with secure protocols and removed unwanted protocols.
Azure	50196	Ensure that Diagnostic logs are enabled in Virtual Machine Scale Sets	Updated predicate to handle all cases
Azure	50237	Ensure that Auditing Retention is greater than 90 days for Azure MSSQL Server	Updated predicate to handle all cases
GCP	52082	Ensure 3625 (trace flag) database flag for Cloud SQL - SQL Server instance is set to on	Enhanced the control according to CIS recommendations and updated the control logic

Issues Addressed

Applicable for: 

We fixed the following important and notable issue in this release.