--- title: Qualys Web Application Scanning (WAS) Connector Guide slug: rbvm-help/qualys-web-application-scanning-was-connector-guide createdAt: 2026-10-26T13:51:23.576Z --- **Summary**: How to set up and use the Qualys Web Application Scanning (WAS) connector in Ivanti Neurons. ## Qualys Web Application Scanning (WAS) Connector Overview Qualys Web Application Scanning (WAS) is a cloud-based web application security scanner that identifies vulnerabilities through automated crawling and testing of custom web applications. Ivanti Neurons offers an API-based connector that integrates Qualys WAS vulnerability information into the Ivanti Neurons platform for further prioritization and accessibility. ## Qualys WAS Configuration - This process requires an account with Qualys and access to the WAS module. - Add one or more Application(s) to Qualys WAS. Create and save a Web Application Report. - View the [Qualys WAS Data Export Guide](docId:_PPWTQF4ZnSO6hI37gQq_) for more information on how to create and save a report. The Qualys WAS Connector only pulls WAS\_WEBAPP\_REPORT scan files. Users must manually upload WEB\_APPLICATION\_SCAN and WAS\_SCAN\_REPORT files, if desired. ### Qualys WAS User Permissions A Qualys **user** can be assigned to one or more **roles**, which consolidate **permissions** that represent the rights to access features and functions. **API Access** can be given to a user when assigning or editing their role. Locate **Users** in the **navigation bar** and either **create or edit** an existing user. In the pop-up window, select a **User Role**. Then, select or deselect the **API** checkbox. Click **Save**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/gZ35cgtyLY6CqvhJ7X1UJ_qualys-web-application-scanning.png" alt="Qualys WAS Connector - New User" position="flex-start" size="98" width="688" height="484" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning.png" showCaption="false"} :::hint{type="info"} For more information, please visit [Qualys.Community](https://qualys-secure.force.com/discussions/s/article/000006319). ::: ## Connector Configuration in Ivanti Neurons ### Setting Up the Qualys WAS Connector Navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Using the search bar in the upper-right corner of the **Integrations** page, type **Qualys** to find the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/crZR-CZ1kCW1YHzP6-XT6_qualys-web-application-scanning1.png" alt="Qualys WAS Connector - Search for Qualys" position="flex-start" size="98" width="686" height="289" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_1.png" showCaption="false"} Locate the **Qualys WAS** card under **Applications** and click **Configuration**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/KMYAxrajQe63Q71M81CBX_qualys-web-application-scanning2.png" alt="Qualys WAS Connector - Qualys WAS Configuration Button Location" position="flex-start" size="36" width="254" height="270" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_2.png" showCaption="false"} In the new window under **Connection**, complete the required fields, as described below. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/Rs91d3RXIHXRFK_AAiUQC_qualys-web-application-scanning3.png" alt="Qualys WAS Connector - Connection Window" position="flex-start" size="83" width="583" height="578" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_3.png" showCaption="false"} - **Name**: The connector’s name. - **URL**: Qualys WAS URL (i.e., https\://qualysapi.qg2.apps.qualys.com/) - **User Name**: The user name that has access to Qualys WAS. - **Password**: The password associated with the username. The Qualys WAS API has a unique constraint for their password policy. If the password contains ‘:', it will throw an error during API calls. In other words, do not use the special character ':' in the password string. - **Network**: Ivanti Neurons network name (ingested applications associated with this network). - **Qualys Was Report Title Prefix**: (Optional) The prefix of the specified reports the user wishes to pull. If no prefix is provided, the API connector will pull all available reports. Click **Test Credentials** to verify the credentials are correct and have access to make API calls to the Qualys WAS instance. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/NC4iv1C3e8wbeAJ8Uhr8G_qualys-asset-connector-guide4.png" alt="Qualys WAS Connector - Test Credentials Button" position="flex-start" size="29" width="202" height="119" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Asset Connector Guide_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Asset Connector Guide_4.png" showCaption="false"} :::hint{type="info"} If your Qualys WAS instance uses whitelisting, contact Ivanti Neurons Support to get the whitelisting IPs. ::: Configure the desired schedule for the connector to retrieve results from the Qualys WAS instance and optionally turn on **Enable auto URBA (Update Remediation by Assessment)**. Users may specify the oldest scan data pull from the following options: 30 days, 60 days, 90 days, 6 months, or 1 year. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/__iUxKWo_N2IsJHeqfTIv_snyk-connector-guide3.png" alt="Qualys WAS Connector - Oldest Scan Pull" position="flex-start" size="52" width="361" height="196" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Snyk Connector Guide_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Snyk Connector Guide_3.png" showCaption="false"} Click **Save** to create the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/_-crHPhK0pWbEvwD3DJoa_qualys-web-application-scanning4.png" alt="Qualys WAS Connector - Save Connector" position="flex-start" size="84" width="590" height="588" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_4.png" showCaption="false"} Once saved, the connector is now visible on the **Integrations** page under **Currently Configured Integrations**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/3GWWE7rxAbL1OwOZ2Aa5y_qualys-web-application-scanning5.png" alt="Qualys WAS Connector - Currently Configured Qualys WAS" position="flex-start" size="40" width="282" height="379" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_5.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_5.png" showCaption="false"} On the **Settings > Uploads** page, Qualys WAS data is parsed from the scan file and displayed on the **Applications** and **Application Findings** pages. ## Qualys WAS Data Mapping in Ivanti Neurons The **Scanner Name** associated with these scans is **QUALYS**, which can be used as a filter on both the **Applications** and **Application Findings** pages in Ivanti Neurons. ### Applications Page Application data extracted from the Qualys WAS scan file is shown on the Applications page as an asset. - Address - URLs - Vulnerability Counts by Severity - Last Scan Date - Operating System ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/grmTb-9A5NHMfhPLNiaTP_qualys-web-application-scanning6.png" alt="Qualys WAS Connector - Applications Page" position="flex-start" size="98" width="687" height="463" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_6.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Qualys Web Application Scanning_6.png" showCaption="false"} ### Application Findings Page All finding data extracted from the Qualys WAS scan file is shown on the **Application Findings** page in Ivanti Neurons. - Findings that are “Ignored” will not be displayed in the Application Findings view - Request/Response is listed under Detailed Information - Additional Metadata Fields: - Source Status (Authentication Required, Authentication Not Required) - Vulnerability Type (Confirmed Vulnerability, Potential Vulnerability, Information Gathered) - Parameter Type - OWASP 2017, WASC, CWE ![Qualys WAS Connector - Application Findings Page](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/lJLQPj-DW3DQEYcUpegy__qualys-web-application-scanning7.png) ### Severity Mapping The Qualys WAS scan file contains severity levels ranging from 1 to 5. Based on the type of plugin, Ivanti Neurons mapped these levels to **Severity** using the CHMLI scale as follows: | **Qualys WAS Plugin Severity** | **Mapping to Ivanti Neurons Severity using CHMLI Scale** | | --------------------------------------------------------- | -------------------------------------------------------- | | **Plugin Type: Confirmed Vulnerability or Vulnerability** | | | 1 | Low | | 2 | Medium | | 3 | High | | 4 | Critical | | 5 | Critical | | **Plugin Type: Potential Vulnerability** | | | 1 | Low | | 2 | Medium | | 3 | High | | 4 | Critical | | 5 | Critical | | **Plugin Type: Information Gathered** | | | 1 | Low | | 2 | Low | | 3 | Low |