Discover Potential Web Applications and APIs

The Discovery tab explores TAS integration with sources to discover potential web applications and APIs from your environment. 

TAS - TotalCloud 

The TAS-TotalCloud integration leverages the configuration of the cloud environment to autonomously identify and catalog potential web applications within your subscription. These potential web applications can be added to your subscription and scanned to identify the vulnerabilities.

To get the WAS-TotalCloud integration, contact your Technical Account Manager or Qualys Support representative.

Once the connection with TotalCloud is activated, the Discovery > Sources tab displays AWS connectors available under your subscription.

To add more connectors, click Create Connector. It opens the Qualys Connector user interface. To learn more about adding a new connector, refer to Create a Connector to Onboard your AWS Organization.

To view and manage discovered web applications, click Discovered Web Applications (xx). It opens the Discovered Web Applications tab. To learn more about managing them, refer to Discovered Web Applications.

VMDR

Your VMDR scan detections are a discovery source. Web applications found on the hosts you already scan with VMDR appear in the Discovery tab.

VMDR must be part of your subscription. Discovery from VMDR reads the findings of your VM scans.

Discovery from VMDR runs once a day, overnight. Each run processes only the detections that are new or have changed since the previous run.

Entries are matched on the URL. If a URL has already been discovered, its existing entry is updated rather than added again.

MuleSoft API Connectors

With the MuleSoft API Connectors, TotalAppSec can discover Swagger files with all endpoints exposed in your environment. This enhances TotalAppSec's discovery feature and strengthens your organization's security posture. 

To create a MuleSoft Connector, navigate to MuleSoft API Connectors and click Create Connector.  

Once the connector is created, the APIs discovered from your environment are displayed in the Discovered APIs tab.

Select Your Anypoint Platform Control Plane

When you create or edit a MuleSoft connector, select the Anypoint Platform URL for the control plane your MuleSoft organization runs on.

Deployed Runtime Endpoints

A MuleSoft API that you have deployed is discovered with the runtime URL on which it is live.

The connector reads API instances and their runtime endpoints from Anypoint API Manager, and specifications from Anypoint Exchange. If you run several environments from the same API connection, each deployment is discovered as its own API candidate.

Discovery pages through the full list of APIs in Anypoint API Manager.

Runtime URL support covers CloudHub 2.0. CloudHub 1.0, Runtime Fabric, and Hybrid deployments are not supported.

An API deployed by uploading a JAR directly to Runtime Manager is not discovered.

Azure API Connectors 

With the Azure API Connectors, TotalAppSec can now discover Swagger files with all endpoints exposed in your Azure environment. This enhances TotalAppSec's discovery feature and strengthens your organization's security posture. 

To create an Azure API Connector, navigate to Azure API Connectors and click Create Connector.  

Once the connector is created, the discovered APIs are displayed in the Discovered APIs tab.

AWS API Connectors

With the AWS API Connectors, TotalAppSec can discover Swagger files with all endpoints exposed in your AWS environment. This enhances TotalAppSec's discovery feature and strengthens your organization's security posture. 

To create an AWS Connector, navigate to AWS API Connectors and click Create Connector.  

Once the connector is created, the APIs discovered from your environment are displayed in the Discovered APIs tab.

Swagger API Discovery 

With Swagger discovery scan, TAS discovers potential Swagger and OpenAPI specification files of the web applications in your subscription. 

To launch API discovery scan, navigate to Applications > Web Applications. Select a web application, and click API Discovery Scan from the Quick Actions. 

The APIs are displayed in the Discovered APIs tab.