Qualys EASM

The Qualys External Attack Surface Management (EASM) module provides continuous discovery and monitoring of an organization's internet-facing assets, including known and unknown external resources. It helps identify exposed assets, misconfigurations, vulnerabilities, and potential security risks to improve visibility and reduce the external attack surface. For more information, refer to the documentation.

Integration Method: API
Tables: Device Inventory Info (5001), Software Inventory Info (5020), OSINT Inventory Info (5021), Vulnerability Finding (2002)

This integration supports the following events.

This integration supports the following versions.

Prerequisites

• The user should have access to Qualys EASM dashboard.

• The user should have access to Qualys user with Reader access to the API.

• The user should have access to the DataBee console.

Configuration Overview

1. Generate client credentials on the Qualys platform with the required scopes.

2. Add the Qualys EASM in the DataBee console with the below parameters.

   DataBee Parameter	Qualys EASM Parameter
   Username	Username
   Password	Password
   Instance	Base Url

Qualys EASM Configuration

1. Sign in to the Qualys Dashboard.
    

2. Navigate to the Users tab.
    

3. Create a new user using the Users > New > User dropdown on the user page.

   

4. Fill in the necessary data in the General Information tab. Then click on User Role.

   

5. In the User Role tab, fill in the role details and make sure we have allowed access to API.

   1. User Role – Reader

   2. Allow access in – API

   3. Keep the Locale, Options, and Security settings as they are and click Save.

   Note:

   Permissions mentioned here are the minimum requirement for the data feed.

   

6. The new user will be created with a Pending Activation status. Also, an activation link will be shared on the email which you have added in the General Information.
    

7. You will receive an email. Save the username securely, as it will be required later when configuring the data source. Then, click Activate Your Account.

   Note:

   Keep the username securely; it will be required later during data source configuration.

   

8. Enter the OTP Code received in email and click on Submit.
    

9. You will get the information below, copy the password, and click on the URL and login with a given username and password.

   Note:

   Keep the password securely; it will be required later during data source configuration.

    

10. When you login with a new username and password for the first time, you will redirect to the verification page, verify your information, and click Save.
     

11. It will redirect to the change password window, the user can set up a new password and login, the user will be in active status, and we will be able to use the API using this username and password.
     

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the Qualys EASM and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click scroll down.
    

5. In the configuration page, confirm the following:

   • API Base URL: Replace API Base URL with the API Gateway URL provided in the documentation below based on your region.
     Reference doc: Identify your Qualys platform

   • Authorization Method: Token Url Auth

   • Username: Paste the Username generated earlier in email.

   • Password: Paste the Password of the account that was set up earlier.

   • Event Types: Preselected for all the event types that integration pulls.

   

6. Click Submit.

Troubleshooting Tips

• Ensure that username and password are correct.

• Ensure that the user has a reader role.

• If you are unable to login with the temporary password, make sure you have given UI Permission to the User.