Release 10.31

December 08, 2024

What’s New?

Qualys Policy Compliance (PC)

Compliance Report Enhancements

With this release, the following reports are enhanced to display more information:

• Authentication Report
• Policy Report

Authentication Report 

With this release, you can now view the list of all asset tags associated with each specific host in the All Asset Tags column of the report. The tags are displayed in PDF format reports and its contents are limited to 255 characters.

If the list of asset tags exceeds this limit, it is represented with an ellipsis (three dots) to indicate the presence of tags beyond 255 characters.

Earlier, if the number of tags associated with each host asset was high, no data was displayed in the authentication report. With this change, you can view the complete data in the authentication report in PDF format.

 This is applicable for Policy Compliance (PC) and Vulnerability Management (VM) authentication reports.

Policy Report

With this release, the CIS data-driven policy report for CIS policies displays HostID and Asset ID information, which allows you to identify the assets for which the CIS policies have been evaluated.

CIS data driven policy report is the dedicated policy compliance report that organizes compliance data according to the CIS references. For more information about this report, refer to CIS Data-Driven Report for CIS Policies.

As a part of this enhancement we have updated the Compliance Policy Report Template by adding a new checkbox Host Id. (Reports > Templates> New/Edit > Policy Template> Layout > Group By- Control Chaining > Host Id checkbox).

On selecting the Host Id checkbox, the report displays the Host ID and Asset ID information under the Results section:

Middleware Technology Support for Mac OS X - M1 

With this release, Mac OS X—M1 agent supports middleware technologies. When using an agent for Policy Compliance, it automatically identifies and tracks middleware technologies assigned to the system. When the Mac OS X agent detects a middleware technology on a host, the details are displayed under PC > Assets > Middleware Assets. 

Compliance Report

The compliance report displays the tracking method and the middleware instances identified by the agent Mac OS X. In the below example, the compliance report displays the tracking method as AGENT with the instance Apple Safari 16.x.

 

Support for New Authentication Technology - Opengear 5.x

With this release, we have added support for Opengear 5.x (Network and Security) for Policy Compliance authenticated scans using Scanners. The new technology is visible in the following scenarios: 

Create and Edit Policies

When you create or edit a policy, Opengear 5.x is now displayed in the list of supported technologies.

Search Controls

When you search for Controls, you see Opengear 5.x in the list of technologies.

Authentication Report

While generating the authentication report, if you select the OS-Authentication-based Technology checkbox, the Results section in the report displays Opengear 5.x in the Host Technology column as shown in the following image:  

Compliance Report

The compliance report displays the tracking method and instances for scanner. You can view the instances of Opengear 5.x for scanned hosts in compliance reports. In the compliance report example below, the tracking method for the scanner is given as IP for the instance 'os'.

For information on the support of Opengear 5.x for auto discovery and vaults, see Authentication Technologies Matrix.

Issues Addressed

The following reported and notable customer issues have been fixed in this release:

Component/Category	Application	Description
VM - SAML Authentication	Vulnerability Management	When the users log into SAML, they are prompted to select the username they wish to use for the account. They must make a selection within 2 minutes. This is the expected behavior. This information is now documented in the article SAML Frequently Asked Questions (FAQ).
VM - Scan Schedule	Vulnerability Management	When the users selected All Scanner in the tagset while executing the scheduled scan, the asset tag service was unavailable. The scheduled task was automatically deactivated. Relevant code changes have been made to fix the issue. When you now schedule a scan and if the asset tag service is unavailable, the scheduled scan will be launched at the next launch time.
VM - Users API	Vulnerability Management	When the users tried to import user preferences, using the API endpoint /api/2.0/fo/user_prefs/, within a subscription, daily trouble ticket updates and Scanner Appliance heartbeat check notifications were not updated after import. The display of an input parameter USER_PREFS in the error message was creating confusion. Relevant code changes have been made to fix the issue.
VM - Report Schedule	Vulnerability Management	When the users edited an existing report schedule containing an Asset Group with special characters, the Asset Group information did not load. Relevant changes were been made to fix the issue. Now the Asset Groups with special characters load on the schedule edit page.
VM - Scan Schedule	Vulnerability Management	When the users edited asset groups in a scheduled vulnerability scan, they were unable to perform delete or refresh actions as the icons were overlapped. Relevant code changes have been made to fix the issue.
VM - Option Profile	Vulnerability Management	When the users created an Option Profile with the Unix Least Privilege Authentication option disabled, it was selected by default when they edited the profile. Relevant code changes have been made to fix the issue. Now, if users disable the Unix Least Privilege Authentication option while creating an Option Profile, it will remain disabled when they edit the profile.
VM - User Management	Vulnerability Management	When the users with the Scanner role tried to edit the authentication record even when the permission was assigned, they were not able to edit. This happened because the user with the scanner role can only view the record created by the manager role. Sub-users (for example, scanner, unit manager role) are only allowed to edit the authentication records created by the same user roles. This is now added in the Online Help under the section Tell me about user roles.
VM - API General	Vulnerability Management	When the users attempted to update the tracking method, for the API endpoint /api/2.0/fo/asset/host/, between IP and DNS for multiple comma-separated host IDs, they encountered error 1905 stating, 'Parameter ids has an invalid value (ID must be a positive integer).' However, updates for a single host ID were successful. Relevant code changes have been made to fix the issue. Users can now update the tracking method for both single and multiple comma-separated host IDs.
VM - Reports General	Vulnerability Management	When the users downloaded a report in CSV format, the headers were incorrectly displayed in the middle of the file when the report was executed using IPV6 ranges starting with letters. Relevant code changes have been made to fix the issue. The headers are now correctly displayed at the top of the CSV file.
PC - Reports	Policy Compliance	When the sub-user (reader user) with privileges for the PC Sub User Access Agent IPs subscription preference and asset tag scoping, attempts to generate a Policy Compliance report for a single IP address, they encounter the error - The hosts are either not in your account or license, or you are not allowed to access them. Relevant code changes have been made to resolve this issue.
PC - Reports	Policy Compliance	When the users generated an authentication report, the report in the PDF format was blank due to the large asset tags associated with the specific host. Relevant code changes were been made to fix the issue.
PC - API	Policy Compliance	When the users executed the API endpoint /api/2.0/fo/compliance/exception/ for the exception list control, an error code 999 was displayed in the exception list output. Relevant code changes were been made to fix the issue.
PC - Schedule Report	Policy Compliance	When the users created a scheduled Policy Compliance report, it was observed that the report did not run at the scheduled time. Also, it took more time to generate in the PDF format than expected. Relevant code changes were been made to fix the issue.
PC - UDC	Policy Compliance	When the users deleted the controls(User Defined Controls) that were present in their UI, the user Activity Log tab did not display the deleted controls. Relevant code changes were been made to fix the issue.