> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/patch/integrations/integrate-qualys.md). # Qualys With a Qualys integration license, you can configure OneSite Patch to collect vulnerability metadata from your Qualys Cloud Agent tool. You can use this metadata to: * Configure patch filters in simple strategies. * Set a trigger to rerun an advanced strategy based on changes to specific metadata. * Configure patch deployment bots to deploy patches based on the metadata. For a full list of imported values from Qualys Cloud Agent, please see the [Metadata properties](#metadata-properties) section below. ### Prerequisites #### Add Qualys license key To enable Qualys integration, you will need either a *OneSite Patch Enterprise for Qualys* key, or a *Qualys add-on for OneSite Patch* key. For more information about acquiring these keys, please reach out to your Sales manager. You can add and view your license keys in the Adaptiva Admin Portal. Please see [License your Adaptiva solution](https://docs.adaptiva.com/platform-guide/license-solution#add-a-license) page for more details. #### Username and password from Qualys account Your region can be determined from your usernames. * If you're unsure of your region, please see Qualys' [Username format](https://www.qualys.com/platform-identification/#:~:text=your%20Qualys%20platform.-,Username%20format,-For%20example%2C%20if) page. * Example: adaptiva\_ab1 * Users are required to have API permissions enabled. ![](/files/VJKXGCiAaPyXcIfXCzKr) For more information on how to setup your Qualys Cloud Agent, please visit the following pages or contact Qualys support: * [Cloud Agent Getting Started Guide](https://docs.qualys.com/en/ca/getting-started-guide/get_started/get_started.htm) * [Download and install the Qualys Cloud Agent](https://docs.qualys.com/en/csam/latest/inventory/sensors/cloud_agent.htm) #### API Host URL Qualys hosted platforms are specified by region or privately hosted platforms by valid API host URIs. * For a full list of valid API host URIs please visit Qualys' [API URLs](https://www.qualys.com/platform-identification/#:~:text=apps.qualysksa.com-,API%20URLs,-Use%20API%20Gateway) page. * Your URI should always begin with `https://qualysapi`. The remainder of the URL must also be well-formed without any query parameters (e.g. ?action=list), path (e.g. /qualys/path/), or fragment (e.g. #page1). * Example: `https://qualysapi.qualys.com` #### Internet connectivity to the Qualys API server You must make sure that the Adaptiva server can access the Qualys API server. This enables the Adaptiva server to: * Verify and save your Qualys access settings. * Regularly download updates to the vulnerability metadata. The default schedule for this is every 8 hours. You can see the integration section of [Plan for OneSite platform installation](https://docs.adaptiva.com/platform-install/planning-guides/onesite-platform-planning#integrations) for a list of the URLs you must add to your allowlist. ### Configure Qualys access in the Adaptiva Admin Portal Follow the steps below of how to connect Qualys access in the Adaptiva Admin Portal. 1. Log in to the **Adaptiva Admin Portal**. 2. Select **OneSite Patch** from the Admin Portal. 3. Select **Qualys** from the left side bar navigation. ![Screenshot of the Qualys access settings page](/files/x3NqozEYnNXSIhVQgg04) 4. Enter in the following into the **Qualys Access Settings**: * **API Host URL** - Enter your API Host URL. See [Prerequisites](#prerequisites) section above. * **Username and Password** - Enter your Qualys Username and Password. See [Prerequisites](#prerequisites) section above. 5. Click **Save**.

When you attempt to save your settings, the Adaptiva portal will try to connect to the Qualys API server with those settings. If the portal cannot successfully authenticate with the entered settings, it will display an error message and will not save the settings. Any connection errors are recorded in the server error logs.

### Custom Qualys Bots When Qualys is integrated into OneSite Patch, you will see Qualys specific bots from the Bots pane. The values above are imported and shared to these bots. ![](/files/r6P6GQU883cmv0HGISw1) ### Metadata properties Qualys uses QIDs (Qualys ID) to organize vulnerabilities in their database. These are different from CVE (Common Vulnerabilities and Exposures) IDs, as a QID can be associated with zero to many CVE IDs, and CVE IDs can be associated with zero to many QIDs. For more information on how QIDs and CVE IDs relate to each other, see [What is a CVE ID and QID](https://success.qualys.com/support/s/article/000003012) on the Qualys support site. Adaptiva organizes vulnerabilities by CVE IDs. Since a CVE ID can be associated with multiple (or zero) QIDs, fields such as `MaxCvssScore`, `MaxEpssScore`, and `MaxQdsScore` only take the highest value from all QIDs that are associated with the CVE ID, or 0.0 if no value can be retrieved from Qualys for that field (this last part does not apply to `MaxQdsScore`, as that field is always expected to have a value). | Property | Description | Values | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------ | | Qualys.ActiveAttacks | True if a given vulnerability is being actively attacked in the wild. | true / false | | Qualys.CisaKnownExploitedVulns | True if a given vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog. | true / false | | Qualys.ConfirmedVulnerability | True if a given vulnerability has the type "Confirmed". False if the vulnerability has the type "Potential" or "Info". | true / false | | Qualys.DenialOfService | True if a given vulnerability has the ability to overload or crash a compromised system, causing temporary or even permanent unavailability. | true / false | | Qualys.EasyExploit | True if a given vulnerability can be exploited with few skills and little overall cybersecurity knowledge. | true / false | | Qualys.ExploitKit | True if a given vulnerability has an associated exploit kit available. | true / false | | Qualys.ExploitPublic | True if a given vulnerability is well known, and code that exploits the vulnerability is publicly available. | true / false | | Qualys.HighDataLoss | True if a given vulnerability, when exploited, can result in a high amount of data lost. | true / false | | Qualys.HighLateralMovement | True if a given vulnerability, when exploited, allows an attacker to propagate that attack over a broader network such as the corp-net of the vulnerable system. | true / false | | Qualys.Malware | True if a given vulnerability is associated with a malware infection | true / false | | Qualys.MaxCvssScore | The maximum Common Vulnerability Scoring System (CVSS) score of a vulnerability. A decimal value with one digit after the decimal place, between 0.0 and 10.0, indicating the severity of a given vulnerability with 10.0 being the most severe. | Decimal value 0.0 to 10.0, 1 decimal place | | Qualys.MaxEpssScore | The maximum Exploit Prediction Scoring System (EPSS) of a vulnerability. A decimal value between 0.0 and 1.0, indicating the likelihood of the specified vulnerability being exploited in the next 30 days. | Decimal value 0.0 to 1.0, 1 decimal place | | Qualys.MaxQdsScore | The maximum Qualys Detection Score (QDS) of a vulnerability. A number between 1 and 100 describing the severity of a given vulnerability as reported by Qualys, with 100 being the most severe. | Integer value 1 to 100 | | Qualys.NoPatch | True if a given vulnerability does not have a fix from the vendor. | true / false | | Qualys.PredictedHighRisk | True if a given vulnerability was predicted by the Qualys Machine Learning model to be high risk based on a variety of input sources. | true / false | | Qualys.PrivilegeEscalation | True if a given vulnerability allows an attacker to gain elevated privileges upon exploiting the vulnerability. | true / false | | Qualys.Ransomware | True if a given vulnerability is associated with known ransomware. | true / false | | Qualys.RemoteCodeExecution | True if a given vulnerability, when exploited, can allow an attacker to run an arbitrary set of commands or code on the targeted system. | true / false | | Qualys.SeverityLevel | One of {"Low", "Medium", "High", "Critical"}. This value comes from the max QDS score for a given vulnerability, where QDS range 1-39 maps to "Low", 40-69 to "Medium", 70-89 to "High", and 90-100 to "Critical". | Low / Medium / High / Critical | | Qualys.SolorigateSunburst | True if a given vulnerability is associated with the supply-chain backdoor, known as Solorigate/SUNBURST, introduced to SolarWinds Orion via a compromised software update mechanism. | true / false | | Qualys.UnauthenticatedExploitation | True if a given vulnerability does not require authentication to exploit. | true / false | | Qualys.Wormable | True if a given vulnerability can be used in worms, allowing it to be spread without user interaction. | true / false | | Qualys.ZeroDay | True if a given vulnerability has no vendor patch available despite an active attack in the wild | true / false |