Product-Specific Workflows

This section provides administrator-level, getting-started guidance for each core module. Activate modules sequentially to avoid overwhelming your team during the initial visibility sprint.

VMDR—Vulnerability Management Detection and Response

VMDR is the foundation of your deployment. Configure it first. All other risk modules draw on the asset and vulnerability data it collects.

Prerequisites

• Connectivity: Cloud Agents or Scanner Appliances deployed and checking in.
• Credentials: Authentication credentials stored in the Qualys Authentication Vault for Windows (WMI/DCOM) and Linux (SSH) targets.
• Permissions: Scanning accounts holding the minimum privileges needed to authenticate on each target OS.

Key Concepts

• Detection: Qualys IDs (QIDs) uniquely identify each vulnerability detection. Qualys maintains more than 100,000 QIDs, updated by the Threat Research team.
• Scan Policy: Defines scan depth, timing, and authentication credentials for a group of assets.
• Option Profile: Controls scanner behavior, including TCP ports, service detection, and OS fingerprinting.
• Remediation Workflow: VMDR integrates with ITSM tools such as ServiceNow and Jira to auto-create remediation tickets.

Day 1 Workflow

1. Confirm agents are checking in and initial asset data is populating in Global AssetView.
2. Create an Authenticated Scan Option profile under Scans > Option Profiles. Enable authentication for Windows (WMI/DCOM) and Linux (SSH).
3. Create your first Scan Policy targeting a pilot tag group (for example, Environment:Staging).
4. Launch a discovery scan to build the initial asset inventory.
5. Launch a full vulnerability scan against the pilot group.
6. Review the VMDR Dashboard. Filter by TruRisk™ score to identify the top 25 highest-risk vulnerabilities.
7. Export a remediation report and share it with your patching team.

Validation Checkpoint: Confirm the pilot group shows authenticated results (not unauthenticated), TruRisk scores are populated, and your remediation report exports cleanly before expanding to additional tag groups.

Global AssetView: Unified Asset Inventory

Global AssetView aggregates data from all Qualys sensors plus third-party connectors into a single, searchable asset record. It is the source of truth for your cyber asset inventory.

Key Features

• QQL (Qualys Query Language): A SQL-like query language for building dynamic asset groups and searches.
• Asset Details Panel: A single-click view of all software, hardware, open ports, vulnerabilities, and compliance posture for any asset.
• Third-Party Connectors: Import asset records from ServiceNow CMDB, AWS, Azure, GCP, Carbon Black, CrowdStrike, and more.

Getting Started

1. Navigate to Global AssetView from the main menu.
2. Use the search bar with QQL to explore your inventory. Example: os.name:Windows AND tags.name:"Production"
3. Create a saved search for each key asset group (for example, all internet-facing Linux servers with critical ACS).
4. Review the Unmanaged Assets widget to identify hosts present on the network but lacking an agent.

Policy Audit (PA)

PA continuously evaluates system configurations against regulatory and industry benchmarks, providing audit evidence and identifying configuration drift.

Supported Frameworks

• CIS Benchmarks (Level 1 and 2) for Windows, Linux, databases, and cloud platforms.
• DISA STIGs for U.S. government and defense compliance.
• PCI-DSS, HIPAA, SOX, NIST 800–53, and ISO 27001 control mappings.

Getting Started

1. Navigate to Policy Audit > Policies.
2. Select a built-in policy template matching your compliance framework (for example, "CIS Benchmark for Windows Server 2022").
3. Clone the policy to create a custom version. Disable or override controls that do not apply to your environment.
4. Assign the policy to an asset tag group.
5. Run the first compliance scan using the PA module's authenticated scan profile.
6. Review the Compliance Posture Dashboard and note pass/fail rates by control category.
7. Use the Exception Workflow to formally document accepted risks with approver sign-off.

Credentials: PA requires authenticated access to evaluate configuration settings. Store scan credentials securely in the Qualys Authentication Vault (Scans > Authentication) and ensure the scanning account holds the minimum required privileges on each target OS.

TotalCloud: Cloud Security Posture Management

TotalCloud provides agentless inventory and misconfiguration detection for your AWS, Azure, GCP, and OCI environments. It connects via cloud provider APIs without requiring agents on cloud instances.

Connector Setup

1. Navigate to TotalCloud > Connectors > Add Connector.
2. Select your cloud provider (AWS, Azure, GCP, or OCI).
3. Follow the guided workflow to create a read-only IAM role (AWS) or Service Principal (Azure) with the minimum required permissions. Qualys provides CloudFormation and ARM templates to automate this.
4. Enter the credentials and save. TotalCloud begins its initial discovery scan, typically 15 to 30 minutes for a mid-size cloud account.
5. Review the TotalCloud dashboard. Assess your CIS Cloud Benchmark pass rate and identify critical misconfigurations such as public S3 buckets, unrestricted security groups, and unencrypted volumes.

Key Controls to Monitor on Day 1

• S3 or Blob Storage with public access enabled.
• Security Groups or NSGs allowing unrestricted inbound 0.0.0.0/0 on ports 22, 3389, or 443.
• Root or admin account without MFA.
• CloudTrail or Activity Log not enabled.
• Default VPC in use for production workloads.

Total AppSec (TAS)

WAS discovers and assesses web applications for OWASP Top 10 vulnerabilities, authentication flaws, and custom business logic issues.

Getting Started

1. Navigate to WAS > Web Applications > Add Web App. Enter the root URL and a display name.
2. Configure crawl scope. Define allowed and excluded URL patterns to prevent scanning out-of-scope endpoints or destructive actions such as DELETE endpoints.
3. Select or create a Scan Option Profile specifying scan depth, authentication (form-based, header, OAuth2), and rate limiting to avoid impacting production.
4. Run a Discovery Scan to enumerate all application pages and entry points before a full vulnerability scan.
5. Run a Vulnerability Scan. Review findings categorized by OWASP category and severity.

Production Scanning: Always schedule WAS scans during off-peak hours for production applications. Configure rate-limiting in the scan option profile, and exclude any endpoints that perform write, delete, or financial transaction operations unless your team has specifically tested for safety.

Container Security

The Container Security module enables vulnerability, compliance, and software composition analysis (SCA) of container images throughout the software lifecycle. It supports image scanning in registries and CI/CD pipelines and provides visibility into running containers and Kubernetes workloads through deployed sensors.

Integration Points

• Registry Scanning: Connect to supported registries such as Docker Hub, Amazon ECR, Azure Container Registry (ACR), Google Container Registry (GCR), Harbor, JFrog Artifactory, and other compatible container registries
• CI/CD Pipeline: Qualys provides CI/CD integrations for Jenkins, GitLab CI, GitHub Actions, and Azure DevOps to automate image scanning and enforce security policies during builds.
• Runtime Monitoring: Deploy the Container Security sensor as a Kubernetes DaemonSet to monitor running pods.

Getting Started

1. Navigate to Container Security > Registries > Add Registry. Enter the registry URL and credentials.
2. Trigger an initial registry scan to baseline all existing images.
3. Configure policy-based gating or vulnerability thresholds in your CI/CD integration to fail builds when vulnerabilities exceed your organization's risk tolerance. Common practices include blocking builds with Critical vulnerabilities or high CVSS scores.
4. Review the Container Inventory view to track image lineage, layer breakdown, and deployment status.