Qualys VMDR — Integration Setup

Prerequisites

• Qualys VMDR subscription
• A Qualys user (ideally a dedicated sub-user) with API access and at least Reader-level permissions
• CMDash Essentials tier or above

Step 1: Prepare a Qualys API Account

1. In the Qualys portal, go to Users and either use an existing account or create a dedicated sub-user for CMDash.
2. Ensure the account has API access enabled (Qualys API access is a per-user permission your Qualys admin can grant under User Roles).
3. Note your Qualys Platform — this determines the API base URL (see table below). It's shown in your account's welcome email or in Help → About.
4. Note the account's username and password.

Security note: Qualys API access uses your account's regular username and password (Basic auth), not a separate API key. Use a dedicated, least-privileged sub-user rather than a personal admin account.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Qualys VMDR and click Connect.
3. Enter:
   • Username (stored as this connection's access token)
   • Password
   • Platform (US1, US2, US3, EU1, EU2, or IN1 — defaults to US1)
4. Click Save & Test Connection.

What Syncs

Qualys's VM API returns XML rather than JSON; CMDash parses the response directly rather than using a full XML parser. Each sync pulls a single batch of up to 500 hosts and up to 500 open detections (New, Active, Re-Opened statuses) — there is no continuation/pagination beyond that first batch today, so environments with more than 500 hosts or 500 open detections will only see a subset per sync. Qualys severity levels 1–5 map to CMDash's info/low/medium/high/critical scale.

Troubleshooting

• 401/403 errors: Confirm the username/password are correct and that API access is enabled for that specific user.
• Empty host or detection list: Confirm at least one scan has completed against the target assets — Qualys only reports hosts/detections that have been scanned.
• Data looks incomplete for a large environment: Only the first 500 hosts and first 500 open detections are captured per sync run; there is currently no pagination beyond truncation_limit=500.
• Connecting to the wrong data center: Qualys is platform-sharded — if you signed up on a EU or India platform but the connection is configured for US1, every call will fail. Check your welcome email or Help → About in the Qualys UI to confirm your platform.

Rate Limits & Sync Behavior

Credential Rotation

Qualys account passwords do not expire automatically unless your organization enforces a password policy. CMDash recommends rotating the dedicated sub-user's password quarterly.

To rotate:

1. In Qualys: reset the sub-user's password (Users → [user] → Edit → Password).
2. In CMDash: Settings → Integrations → Qualys VMDR → Edit.
3. Enter the new Password and Save.

Note: Because Qualys credentials carry no expiry metadata CMDash can read, the 30-day expiry warning banner is not shown for this integration.

Multiple Instances / Multi-Site

If you have Qualys subscriptions on more than one platform (e.g., a US1 subscription and a separate EU1 subscription for a European subsidiary), each needs its own CMDash connection.

To add another instance:

1. In CMDash: Settings → Integrations → Add Integration → Qualys VMDR.
2. Enter the username, password, and platform for the additional subscription.
3. Give the connection a descriptive name (e.g., Qualys - US1, Qualys - EU1).
4. Click Save & Test Connection.

Compliance Framework Coverage

The Qualys integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.