Reporting and Dashboards

Qualys provides a rich, customizable reporting layer that serves audiences from SOC analysts to the CISO. Configure dashboards and reports early to ensure consistent visibility throughout your 30-day sprint and beyond.

Configuring Your Initial Dashboards

The VMDR and Global AssetView modules both offer widget-based dashboards that you can fully customize per user.

Recommended Day-1 Dashboard Widgets

• TruRisk Score Trend: Track your overall TruRisk score over time to demonstrate risk reduction.
• Top 10 Vulnerabilities by TruRisk: A prioritized remediation queue for your patching team.
• Asset Coverage by Tag: Confirm scan coverage across every tagged environment and business unit.
• Mean Time to Remediate (MTTR): Track remediation velocity by severity tier.
• New vs. Remediated Vulnerabilities: Validate that your remediation rate exceeds your introduction rate.
• Compliance Posture Gauge (PC): A high-level pass/fail rate for your primary compliance framework.
• Cloud Misconfiguration Summary (TotalCloud): A count of critical misconfigurations by cloud provider.

Best Practice: Role-Based Dashboards: Create separate dashboard views for SOC analysts (operational detail), system administrators (asset-level findings), and the CISO (executive KPIs and trend lines). Use the "Share Dashboard" feature to publish views without granting edit permissions.

Report Types

Qualys provides four primary report categories:

• Scan Reports: Detailed output from a specific scan run. Useful for point-in-time audit evidence.
• Remediation Reports: Action-oriented reports grouped by vulnerability, asset, or assigned remediation team. Integrates with ITSM ticket creation.
• Compliance Reports: Policy pass/fail results mapped to specific controls. Exported in PDF, HTML, or CSV for auditor submission.
• Executive Reports: Configurable KPI scorecards with trend charts. Targeted at management and board-level stakeholders.

Configuring Alerts and Notifications

Proactive alerting keeps your team informed of critical events without relying on manual dashboard checks.

Alert Types to Configure

• New Critical or High vulnerability detected on ACS 4 or 5 assets: immediate email and/or SIEM alert.
• Scan failure or appliance offline: prevents gaps in detection coverage.
• New unmanaged asset detected (CSAM): flags shadow IT and rogue devices.
• Compliance posture drop greater than 5% in a 24-hour period: indicates possible configuration drift or ransomware activity.
• Critical cloud misconfiguration introduced: public cloud exposure event.

Notification Channels

• Email: Built-in SMTP-based notification, configurable per user and per alert type.
• Webhook: Push alerts to Slack, Microsoft Teams, PagerDuty, or any REST endpoint.
• SIEM Integration: Forward events via syslog or direct API to Splunk, Microsoft Sentinel, IBM QRadar, or Sumo Logic using the Qualys Connector Framework.
• ITSM Ticketing: Auto-create ServiceNow or Jira issues for new critical vulnerabilities using the VMDR Remediation module.

Qualys APIs for Custom Reporting

For organizations with mature security operations, Qualys provides comprehensive REST and legacy XML APIs for all platform functions.

• API Documentation: Qualys APIs
• Common use cases: Automated report generation, CMDB enrichment, SIEM data ingestion, and custom risk dashboards.

Rate Limiting: Qualys APIs enforce rate limits based on subscription tier. For high-volume integrations, use the Qualys Notification Service (QNS) webhooks rather than polling the API. Contact your TAM for API concurrency limits specific to your subscription.