Qualys Policy Compliance (PC) Connector Guide
Summary: How to set up and use the Qualys Policy Compliance (PC) connector in Ivanti Neurons RBVM/ASPM/VULN KB.
Introduction
The Ivanti Neurons RBVM/ASPM/VULN KB Qualys Policy Compliance (PC) connector integrates with Qualys's compliance cloud application, Policy Compliance. You can configure the connector to pull reports generated by the PC module. Currently, the connector ingests Qualys Policy Compliance Reports. Neurons RBVM/ASPM/VULN KB presents data from the Policy Report as Hosts and Host Findings.
Qualys PC Overview
Qualys PC is a cloud service that performs automated security configuration assessments on IT systems. The PC module requires an additional subscription and is shown as an option when enabled. With PC, users can leverage out-of-the-box library content to allow compliance assessments to use industry-recommended best practices such as CIS Benchmarks and DISA STIGs, which can be fully customized to meet an organization's unique needs.
Refer to the Qualys PC guide for details on setting up and using the Qualys PC module.
Connector Configuration
Qualys Setup
This setup requires a Qualys PC subscription.
First, create a Policy Report, as the RiskSense connector will pull this report.
Using the schedule option, users can schedule the report generation periodically when creating a Policy Report. Since policy compliance reports are based on the most recent scans for each host, you should already have a scan set up for the report generation to be successful.
RiskSense Connector Setup
Navigate to the Automate > Integrations page.
In the search bar in the upper-right corner of the Integrations page, type Policy Compliance to find the connector.
Locate the Qualys Policy Compliance card on the page and click Configuration.
In the new window under Connection, complete the required fields, as described below.
- Name: The connector's name.
- URL: The URL to access Qualys PC.
- User Name: User name that has access to Qualys PC.
- Password: The password associated with the Qualys PC user name.
- Network: Network name in RiskSense. Ingested hosts and findings will be associated with this network.
- Qualys Report Title Prefix: The prefix comes from the Policy Report title used when creating the Policy Report in Qualys.
Click the Test Credentials button to ensure the credentials are correct and have the necessary access to Qualys PC.
Under Schedule, you can configure the desired schedule for the connector to retrieve results from the Qualys PC instance.
Under Connector Specific Options, you can optionally turn on Enable auto URBA (Update Remediation by Assessment). Click the Save button to save the connector's configuration and create the connector.
Once saved, the connector is now visible on the Integrations page under Currently Configured Integrations.
Click the History button to display the connector details for each pull.
The Sync button allows users to perform on-demand sync. The Edit button allows the user to edit the connector configuration. The Delete button allows the user to delete the connector.
Qualys PC Data Mapping in RiskSense
RiskSense ingests Qualys PC scan file data as Hosts and Host Findings. QUALYSPC is the scanner name associated with Qualys PC scans. You can use this scanner name as a filter on both the Hosts and Host Findings pages.
Hosts Page
Any asset data extracted from the scan file is shown on the Hosts page. Both IP address and hostname are extracted from the scan file.
Asset Tag data from the scan file is converted to tags on each asset. Within RiskSense, Asset Tag data is shown in the Host Detail pane. In the Host Detail pane, the scanner is listed as QUALYSPC under the Sources section.
Host Findings View
All findings from the Qualys PC scan file are shown in the Host Findings view in RiskSense.
- Since these findings are of the compliance type, they are either reported as Passed or Failed in the scan file. When a Passed finding is ingested, its Status is set to Closed. When a Failed finding is ingested, its Status is set to Open.
- Four filters are provided in the Host Findings list view. These filters are based on information collected from the scan file.
- PolicyCompliance:Test Status: Use this filter to filter on Passed or Failed findings. The Test Status is shown in the Host Finding Detail view under the Observations section.
- PolicyCompliance:Technology: This filter is based on the values gleaned from the "Technology" tag in the scan file. This value is shown in the Host Finding Detail view in the top-most section.
- PolicyCompliance:Expected Result: This filter is based on the expected result of a check done as part of the scan. This information is shown in the Output section in the Host Finding Detail view.
- PolicyCompliance:Actual Result: This filter is based on the actual result of a check done as part of the scan. This information is shown in the Output section in the Host Finding Detail view.
Severity Mapping
The Qualys PC scan file contains five different severity levels: Urgent, Critical, Serious, Medium, and Minimal. These levels are mapped to the CHMLI scale in Neurons RBVM/ASPM/VULN KB, as shown in the table below.
Qualys PC Severity and Value | Mapping to Neurons RBVM/ASPM/VULN KB CHMLI Scale |
|---|---|
Urgent – 5 | Critical |
Critical – 4 | High |
Serious – 3 | Medium |
Medium – 2 | Low |
Minimal – 1 | Informational |