Preparing for the Qualys Vulnerability Integration
Summarize
Summary of Preparing for the Qualys Vulnerability Integration
Preparing for the Qualys Vulnerability Integration is crucial for effective vulnerability management. This process requires careful planning and execution of various pre-integration tasks to ensure a successful integration with the Qualys Cloud Platform.
Show less
Important prerequisites
- Validate the instance sizing based on the number of vulnerable items expected for import to avoid long load times. Contact Customer Service if sizing is unknown.
- Utilize filtering to limit the initial import of items and phase deployment with adjusted filters in subsequent imports.
- Qualys scanners are deactivated by default in the Vulnerability Response application; ensure to manage rescans appropriately.
Actions to take
- Determine an initial start date for Host Detection List Import integrations, ideally on or before the date of the last Qualys scan.
- Add users to necessary admin roles (admin, snvuln.admin, snvulqualys.admin) for proper access.
- Keep the default run-as user for each integration record as VR.System.
- Disable the default vulnerability calculator if it’s not needed to enhance performance during the initial import.
- Prior to the initial import, disable notification-related business rules to prevent performance issues.
- Prepare your Qualys server URL and authentication credentials with the necessary permissions for integration.
- If using host tags in Vulnerability Response Assignment or Vulnerability Group Rules, ensure the Qualys Host List integration is completed first.
A successful integration requires planning and careful execution of pre-integration tasks. It is essential that you prepare for the integration by performing these procedures. The Qualys Vulnerability Integration assumes that you are familiar with and run Qualys Cloud Platform scans in your environment.
Important prerequisites
Validate your instance sizing based on the number of vulnerable items you expect to import. An undersized instance can lead to long load times. If you do not know the size of your instance, contact Customer Service and Support.
Use filtering to limit the number of items for initial import and phase your deployment by adjusting filters in subsequent imports.
The Qualys scanners are deactivated by default in the Vulnerability Response application. If you try to perform a rescan from the vulnerable items or remediation tasks that have these applications as a source, the Rescan button is not available.
Actions to take
- Determine an initial start date for Host Detection List Import integrations.
Consider setting the Start time field to a few hours or days in the past. Ideally, choose the date of the last Qualys scan. The start date can include vulnerabilities discovered prior to using the vulnerability management solution. Set the earliest start time used to the start of your scanning cycle. So, if it takes a week before all hosts are scanned, set this value to a week prior to that time.
- Add users to the roles for admin, sn_vuln.admin, and sn_vul_qualys.admin. For more information see, Assign a role to a user.
There is a configured run-as user for each integration record. The default value for this user is VR.System. Do not change this value.
- If you do not use vulnerability calculators, Disable the default vulnerability calculator if not used, in addition to any others you have defined. Vulnerability calculators run every time a vulnerable item record is created or updated, and can impact initial import performance.
- During the initial import of records, certain notification-related business rules can cause many notifications to be generated, impacting performance. Prior to your initial import, disable the business rules.
- If you wish to use a different scanner than the Qualys default, see set up scanner appliances.
- Have your Qualys server URL and authentication credentials ready. The credentials must provide adequate permissions for retrieving knowledge, scan, and detection information for a Qualys subscription.
- If you plan to use host tags in Vulnerability Response Assignment or Vulnerability Group Rules, ensure the Qualys Host List integration was run prior to creating rules.