How to Track Historical Changes in Qualys Detection Score (QDS)

This topic includes how you can track historical changes in QDS, since VM does not provide native historical tracking in the UI or standard reports.

Prerequisites

Before you begin, ensure the following requirements are met:

• You have a valid subscription to the VM or VMDR module.
• Your user account has permissions to create and run reports. Manager or Unit Manager roles are recommended.
• Asset Groups are already configured and contain the assets you want to monitor for QDS changes.
• Vulnerability scan data is available for the target assets.

QDS is a dynamic score assigned to vulnerabilities that helps you prioritize remediation based on risk. The Qualys Detection Score (QDS) ranges from 1 to 100 and is calculated using multiple risk factors, including CVSS severity, threat intelligence, malware associations, active exploitation data, vulnerability age, and the presence of public exploits. Because these factors continuously change as new threat information becomes available, the QDS value for a vulnerability can increase or decrease over time.

The current QDS value is displayed in the VM module. However, the module displays only the latest QDS value and does not maintain a built-in history of previous scores. To track historical QDS trends and analyze how vulnerability risk changes over time, you must capture and save the QDS data externally.

To track historical changes in QDS:

1. In the VM Module > click on the Reports tab > Templates.
2. Click New > Scan Template > QID Based Template.
   
3. The New Scan Report Template page opens. Locate and click the Display tab.
4. Select the Vulnerability Details and TruRisk Details (TruRisk Score, ACS, QDS) checkboxes.
5. Click Save.
   

To download and save a report:

1. In the VM Module, click Reports tab > Reports.
2. Click New > Scan Report.
   The New Scan Report page opens.
3. Under Reports Details, in the Title box, type a report name.
4. Under Report Source > Asset Groups > select an asset group that contains assets you want to track for historical QDS changes > Click Run.
   

To generate a report:

1. In the VM Module > Reports tab > Template > select the new report template with the required vulnerability and QDS settings configured.
2. Click Run.
   Report generates.
3. Download and save the report to track historical changes.
   

To collect and save the historical QDS data, schedule the report to run automatically at regular intervals.

To schedule automatic report generation in regular intervals:

1. In the VM module > click the Reports tab > Schedules.
   Click on the New list > Scan Report > Template Based.
   
2. In the New Scan Report dialog box, scroll down to Report Options section, click the Scheduling checkbox.
3. Set the report start date, time, and time zone.
4. Under Occurs, choose how frequently the report should run. Select Daily for critical environments that require frequent monitoring. Select Weekly or Monthly for standard monitoring requirements.

4. Click Schedule to save the scheduled report configuration.
   

This creates a timeline of QDS values across multiple reports.

By capturing and storing QDS data externally, you maintain a historical record of QDS values, track vulnerability risk trends over time, and effectively work around the lack of native QDS history in VM platform.

Automated QDS Tracking

You can track historical QDS data programmatically by using the VM API. Enterprise environments use the /api/2.0/fo/asset/host/vm/detection/ API endpoint to retrieve vulnerability detection data, including QDS-related information for assets and QIDs. To include QDS values in the API response, specify the show_qds=1 parameter in the request. If show_qds=0 is specified, QDS values are not included in the output. Organizations using Qualys API versions 3.0, 4.0, or 5.0 can use the equivalent VM/VMDR API functionality available in their respective platform versions. 

You can schedule periodic API exports using external automation tools such as PowerShell scripts, or SIEM/SOAR integrations, and then store the exported data in a database or reporting platform for long-term trend analysis.

By capturing and storing QDS data externally through scheduled reports or API-based exports, you maintain a historical record of QDS values. With this you can track vulnerability risk trends over time, and work around the lack of native QDS history in the VM platform.

Capture and store QDS data externally using scheduled reports or API exports. This creates a historical record of QDS values and helps track vulnerability risk trends over time. It also compensates for the lack of native QDS history in the VM platform.

If you need help configuring report templates or analyzing QDS data, contact Qualys Support for further assistance.