![qualys icon](/docs/img/components/icons/60/cXVhbHlz.png) # Qualys Connector key: qualys[Source](https://github.com/prismatic-io/components/tree/main/components/qualys)[API Docs](https://docs.qualys.com/en/vm/qweb-all-api/)[API Docs (CSAM)](https://docs.qualys.com/en/csam/api/)[API Changelog](https://notifications.qualys.com/api)[Connector Changelog](#changelog) ## Description[​](#description "Direct link to Description") [Qualys](https://www.qualys.com/) is a cloud-based security and compliance platform that provides vulnerability management, asset inventory, and risk scoring through its VMDR (Vulnerability Management, Detection, and Response) solution. This component allows managing assets, tags, VM scans, TruRisk scores, and remediation tickets across the Qualys Gateway and Classic APIs. #### API Documentation[​](#api-documentation "Direct link to API Documentation") This component was built using the following API references: * [Qualys VMDR API](https://docs.qualys.com/en/vm/qweb-all-api/) for the Classic API surface * [Qualys CSAM Asset Search API](https://docs.qualys.com/en/csam/api/asset_host_data/get_host_details_of_all_assets.htm) for the Gateway API surface ## Connections[​](#connections "Direct link to Connections") ### Basic Authentication[​](#qualys "Direct link to Basic Authentication") **key: qualys** To authenticate with Qualys, a platform username and password are required along with the API base URLs for the account's assigned pod. #### Prerequisites[​](#prerequisites "Direct link to Prerequisites") * A Qualys subscription with API access enabled * A user account with the appropriate role (e.g., Manager, Unit Manager, or Reader depending on the actions used) * The Gateway and Classic API base URLs for the assigned Qualys platform pod #### Setup Steps[​](#setup-steps "Direct link to Setup Steps") 1. Log in to the Qualys platform 2. Confirm that API access is enabled for the account. API access is controlled by the Qualys subscription administrator 3. Identify the platform pod by visiting the [Platform Identification](https://www.qualys.com/platform-identification) page. Each pod has distinct Gateway and Classic API base URLs 4. Note the **Gateway API URL** (e.g., `https://gateway.qg1.apps.qualys.com`) and the **Classic API URL** (e.g., `https://qualysapi.qg1.apps.qualys.com`) for the assigned pod #### Configure the Connection[​](#configure-the-connection "Direct link to Configure the Connection") * Enter the **Username** for the Qualys platform account * Enter the **Password** for that account * Enter the **Gateway API URL**, the base URL for the Qualys Gateway (CSAM/GAV) API on the assigned pod * Enter the **Classic API URL**, the base URL for the Qualys Classic (VM/PC) API on the assigned pod | Input | Notes | Example | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | Classic API URL | Base URL for the Qualys Classic (VM/PC) API. Find the pod URL at [Platform Identification](https://www.qualys.com/platform-identification). | https\://qualysapi.qg1.apps.qualys.com | | Gateway API URL | Base URL for the Qualys Gateway (CSAM/GAV) API. Find the pod URL at [Platform Identification](https://www.qualys.com/platform-identification). | https\://gateway.qg1.apps.qualys.com | | Password | Qualys platform password. | s3cur3P\@ss | | Username | Qualys platform username. | qualys-api-user | ## Triggers[​](#triggers "Direct link to Triggers") ### Changed Assets[​](#changedassets "Direct link to Changed Assets") Checks for assets that have changed since the last execution on a configured schedule. Uses the Gateway asset search with a last-modified filter and persists the watermark via polling state. Note: echo suppression is NOT built into this trigger. If the flow pushes assets back to Qualys, those writes will re-appear as changes on the next poll. Implement echo suppression at the flow level using outbound push timestamps. | **key: changedAssets** | Input | Notes | Example | | -------------------- | ------------------------------------------------------------------------------------- | ------- | | Connection | The Qualys connection to use. | | | Show New Records | When enabled, assets created since the last poll are included in the trigger output. | true | | Show Updated Records | When enabled, assets modified since the last poll are included in the trigger output. | true | This trigger polls the [Qualys Gateway asset search API](https://docs.qualys.com/en/csam/api/asset_host_data/get_host_details_of_all_assets.htm) for assets that have been modified since the last recurrence. #### How It Works[​](#how-it-works "Direct link to How It Works") 1. The trigger runs on the configured schedule (e.g., every 5 minutes) 2. It queries the Gateway API for assets modified since the last recurrence using the `assetLastUpdated` filter 3. Results are paginated automatically using keyset cursor pagination, collecting all matching assets across pages 4. If the API returns HTTP 416 (page size exceeds available results), the page size is halved and the request is retried 5. The trigger persists the poll timestamp via polling state so the next execution picks up where it left off **Batching** Batching is enabled per flow on this trigger. Once enabled, each changed record is dispatched as its own execution, or grouped by the configured batch size. Batch size and the number of batches dispatched concurrently can both be overridden per instance. Raising concurrency increases the request volume sent to Qualys. To turn it on, select the flow's trigger, open the **Flow control** tab, and switch on **Enable Batching**. Under **Batch Size**, keep **Trigger default** to use the size this trigger ships with, or choose **Custom batch size** to set a specific size. **Batch Concurrency** is optional; leave it blank for no batch-level limit. With batching off, a downstream step reads changed assets from `payload.body.data.createdRecords` and `payload.body.data.updatedRecords`. With batching on, the trigger resolver flattens both arrays into individual asset items, and those object paths do not exist. Any step that reads the unbatched shape must be updated before batching is enabled. Because batching is enabled per flow, the change is scoped to that flow rather than to the component or to other flows using the same trigger. #### Returned Data[​](#returned-data "Direct link to Returned Data") The trigger returns an object with two arrays. Each asset is placed in `createdRecords` or `updatedRecords` by comparing its `createdDate` against the minute-truncated watermark from the previous recurrence, and the **Show New Records** and **Show Updated Records** toggles control which arrays are populated. The first recurrence seeds the watermark at the current timestamp and returns only assets changed at or after that point, with no historical backfill. Change detection proceeds from there. Example Response ```json { "data": { "createdRecords": [ { "assetId": 1225180002, "assetUUID": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "assetType": "HOST", "assetName": "Server02.example.com", "dnsName": "server02.example.com", "fqdn": "server02.example.com", "netbiosName": "SERVER02", "address": "10.0.1.60", "operatingSystem": { "osName": "Microsoft Windows Server 2016 Standard 10.0.14393 64-bit N/A Build 14393", "category": "Windows / Server", "productName": "Windows Server 2016", "publisher": "Microsoft" }, "createdDate": "2026-08-18T02:41:05.000Z", "lastModifiedDate": "2026-08-18T02:41:05.000Z" } ], "updatedRecords": [ { "assetId": 1225180001, "assetUUID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "assetType": "HOST", "assetName": "Server01.example.com", "dnsName": "server01.example.com", "fqdn": "server01.example.com", "netbiosName": "SERVER01", "address": "10.0.1.60", "operatingSystem": { "osName": "Microsoft Windows Server 2016 Standard 10.0.14393 64-bit N/A Build 14393", "category": "Windows / Server", "productName": "Windows Server 2016", "publisher": "Microsoft" }, "createdDate": "2026-08-11T07:28:23.000Z", "lastModifiedDate": "2026-08-18T02:42:33.000Z" } ] } } ``` Fields shown are representative. The full response object includes additional properties. #### Notes[​](#notes "Direct link to Notes") * Echo suppression is NOT built into this trigger. If the flow pushes assets back to Qualys, those writes will re-appear as changes on the next poll. Implement echo suppression at the flow level using outbound push timestamps. Example Payload for Changed Assets[⤓](https://prismatic.io/docs/example-payloads/qualys/triggers/changedAssets.json "Download example payload") Loading… *** ## Data Sources[​](#data-sources "Direct link to Data Sources") ### Select Asset Group[​](#selectassetgroup "Direct link to Select Asset Group") Fetch asset groups from Qualys for use in dropdown selectors (e.g., scan targeting). | **key: selectAssetGroup** | **type: picklist** | Input | Notes | Example | | ---------- | ----------------------------- | ------- | | Connection | The Qualys connection to use. | | Example Payload for Select Asset Group[⤓](https://prismatic.io/docs/example-payloads/qualys/data-sources/selectAssetGroup.json "Download example payload") Loading… *** ### Select Scanner Appliance[​](#selectscannerappliance "Direct link to Select Scanner Appliance") Fetch scanner appliances from Qualys for use in dropdown selectors. Required when launching a VM scan against targets not covered by Cloud Agent. | **key: selectScannerAppliance** | **type: picklist** | Input | Notes | Example | | ---------- | ----------------------------- | ------- | | Connection | The Qualys connection to use. | | Example Payload for Select Scanner Appliance[⤓](https://prismatic.io/docs/example-payloads/qualys/data-sources/selectScannerAppliance.json "Download example payload") Loading… *** ### Select Tag[​](#selecttag "Direct link to Select Tag") Fetch tags from Qualys for use in dropdown selectors. | **key: selectTag** | **type: picklist** | Input | Notes | Example | | ----------- | ---------------------------------------------------------------------------- | ------- | | Connection | The Qualys connection to use. | | | Static Only | When true, only return static tags (excludes dynamic tags with a rule type). | false | Example Payload for Select Tag[⤓](https://prismatic.io/docs/example-payloads/qualys/data-sources/selectTag.json "Download example payload") Loading… *** ## Actions[​](#actions "Direct link to Actions") ### Create Tag[​](#createtag "Direct link to Create Tag") Create a new tag in Qualys using the Asset Management & Tagging (QPS) API. | **key: createTag** | Input | Notes | Example | | ----------------- | -------------------------------------------------------------------------------------------------------- | ------------------------- | | Color | A hex color code (e.g. #FF5733) used to visually distinguish the tag in the Qualys UI. | #FF5733 | | Connection | The Qualys connection to use. | | | Criticality Score | Tag criticality score (1-5). Qualys derives an asset's criticality as the maximum score across its tags. | 3 | | Parent Tag ID | Filter tags by parent tag ID, or set the parent when creating a tag. | 100 | | Rule Text | Tag rule expression. Required for dynamic rule types (GROOVY, OS\_REGEX, etc.). | Windows.\*Server | | Rule Type | Tag rule type (e.g., STATIC, GROOVY, OS\_REGEX, NETWORK\_RANGE). | STATIC | | Tag Name | A descriptive label for the tag, such as 'LS:Environment=Production'. | LS:Environment=Production | Example Payload for Create Tag[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/createTag.json "Download example payload") Loading… *** ### Delete Remediation Tickets[​](#deleteremediationtickets "Direct link to Delete Remediation Tickets") Bulk-delete remediation tickets by filter. Defaults to dry-run mode — set Dry Run to false to perform the actual deletion. Up to 20,000 tickets per call. Requires Manager or Unit Manager role. There is no undo. | **key: deleteRemediationTickets** | Input | Notes | Example | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | | Assignee | Filter tickets assigned to this user's email address. | user\@example.com | | Connection | The Qualys connection to use. | | | Dry Run | When true (default), returns the tickets that would be deleted without actually deleting them. Set to false to perform the deletion. There is no undo. | true | | Severity | Filter tickets by vulnerability severity (1-5). | 4 | | Ticket Numbers | Specific ticket numbers to retrieve or act on. | 12345 | | Ticket State | Filter tickets by their current workflow state. | OPEN | Example Payload for Delete Remediation Tickets[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/deleteRemediationTickets.json "Download example payload") Loading… *** ### Edit Remediation Tickets[​](#editremediationtickets "Direct link to Edit Remediation Tickets") Bulk-edit remediation tickets: reassign, change state, or add comments. Up to 20,000 tickets per call. Requires Manager or Unit Manager role — Scanner or Reader credentials silently fail to act on tickets outside the caller's own account. | **key: editRemediationTickets** | Input | Notes | Example | | -------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------- | | Comment | Add a comment to the selected tickets. | Patch applied, awaiting verification. | | Connection | The Qualys connection to use. | | | New Assignee | Reassign selected tickets to this user. | user\@example.com | | New State | Change the state of selected tickets. A Closed/Fixed or Closed/Ignored ticket cannot be changed to Resolved. | OPEN | | Ticket Numbers | Specific ticket numbers to retrieve or act on. | 12345 | Example Payload for Edit Remediation Tickets[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/editRemediationTickets.json "Download example payload") Loading… *** ### Get Asset[​](#getasset "Direct link to Get Asset") Retrieve a single asset by ID from the Qualys inventory using the Gateway asset search API. | **key: getAsset** | Input | Notes | Example | | ---------- | ---------------------------------------------- | ------- | | Asset ID | The unique identifier for the asset in Qualys. | 12345 | | Connection | The Qualys connection to use. | | Example Payload for Get Asset[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/getAsset.json "Download example payload") Loading… *** ### Get Remediation Ticket Info[​](#getremediationticketinfo "Direct link to Get Remediation Ticket Info") Retrieve detailed information for specific remediation tickets by ticket number or by last-modified timestamp. | **key: getRemediationTicketInfo** | Input | Notes | Example | | -------------- | -------------------------------------------------------------------------------- | -------------------- | | Connection | The Qualys connection to use. | | | Since | Return tickets updated on or after this date/time. Format: YYYY-MM-DDTHH:MM:SSZ. | 2024-01-01T00:00:00Z | | Ticket Numbers | Specific ticket numbers to retrieve or act on. | 12345 | Example Payload for Get Remediation Ticket Info[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/getRemediationTicketInfo.json "Download example payload") Loading… *** ### Launch VM Scan[​](#launchscan "Direct link to Launch VM Scan") Launch a vulnerability management scan against asset groups or tags. Asynchronous — returns a scan reference immediately, not results. Use List Scans to track status. Requires an existing scan option profile and at least one online scanner appliance or Cloud Agent scoped to the targets. | **key: launchScan** | Input | Notes | Example | | ----------------- | ------------------------------------------------------------------------------------------ | ------------------------- | | Asset Group IDs | Asset group IDs identifying the assets to scan. | 54321 | | Connection | The Qualys connection to use. | | | Option Profile ID | ID of the scan option profile to use. Select from the Option Profile data source. | 12345 | | Scanner Appliance | Name or ID of the scanner appliance. Required when targets are not covered by Cloud Agent. | | | Scan Title | A descriptive name to identify the scan in Qualys. | Weekly Vulnerability Scan | | Target Tag IDs | Tag IDs identifying the assets to scan. | 12345 | Example Payload for Launch VM Scan[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/launchScan.json "Download example payload") Loading… *** ### List Asset Risk Data[​](#listassetriskdata "Direct link to List Asset Risk Data") Retrieve TruRisk scores, vulnerability counts, and derived risk bands from the Classic VM host list API. This is the only source for TruRisk data — the modern Gateway asset API does not return vulnerability information. Returns the VM (Classic) TruRisk score, not the CSAM figure. | **key: listAssetRiskData** | Input | Notes | Example | | ---------- | --------------------------------------------------------------------------------------- | ------- | | Connection | The Qualys connection to use. | | | Fetch All | When true, automatically fetches all pages of results. | false | | Page Size | The maximum number of results to return per page. The API default applies when omitted. | 100 | Example Payload for List Asset Risk Data[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/listAssetRiskData.json "Download example payload") Loading… *** ### List Assets[​](#listassets "Direct link to List Assets") Search for assets in the Qualys inventory using the Gateway asset search API. Supports keyset cursor pagination and field selection. | **key: listAssets** | Input | Notes | Example | | ------------------- | ---------------------------------------------------------------------------------------------- | -------------------- | | Connection | The Qualys connection to use. | | | Exclude Fields | Field names to omit from the response payload, reducing response size. | | | Fetch All | When true, automatically fetches all pages of results. | false | | Include Fields | Fields to include in the response. When set, only these fields are returned. | | | Last Modified Since | Filter assets modified after this date/time (ISO 8601). Used as an incremental sync watermark. | 2024-01-01T00:00:00Z | | Pagination | Page size and cursor controls for keyset pagination. | | Example Payload for List Assets[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/listAssets.json "Download example payload") Loading… *** ### List Remediation Tickets[​](#listremediationtickets "Direct link to List Remediation Tickets") List remediation tickets from the Classic API. Maximum 1,000 tickets per call — the API truncates silently beyond that limit. The response includes a truncation flag so callers can detect incomplete results. | **key: listRemediationTickets** | Input | Notes | Example | | -------------- | ----------------------------------------------------------------------------------------------- | ----------------- | | Assignee | Filter tickets assigned to this user's email address. | user\@example.com | | Connection | The Qualys connection to use. | | | Modified Since | Return tickets modified on or after this date/time. Format: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ. | 2024-01-01 | | Severity | Filter tickets by vulnerability severity (1-5). | 4 | | Ticket State | Filter tickets by their current workflow state. | OPEN | Example Payload for List Remediation Tickets[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/listRemediationTickets.json "Download example payload") Loading… *** ### List Scans[​](#listscans "Direct link to List Scans") List VM scans from the Classic API. This is the only way to check a launched scan's status — there is no dedicated status endpoint. | **key: listScans** | Input | Notes | Example | | -------------- | ------------------------------------------------------------------ | --------------------- | | Connection | The Qualys connection to use. | | | Launched After | Filter scans launched after this date (YYYY-MM-DD). | 2024-01-01 | | Scan Reference | Filter scans by reference ID (e.g., scan/1234567890.12345). | scan/1234567890.12345 | | Scan State | Filter scans by execution state. Use Running to find active scans. | Running | Example Payload for List Scans[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/listScans.json "Download example payload") Loading… *** ### List Tags[​](#listtags "Direct link to List Tags") Search for tags in Qualys using the Asset Management & Tagging (QPS) API. | **key: listTags** | Input | Notes | Example | | ------------- | --------------------------------------------------------------------------------------- | ------- | | Connection | The Qualys connection to use. | | | Fetch All | When true, automatically fetches all pages of results. | false | | Page Size | The maximum number of results to return per page. The API default applies when omitted. | 100 | | Parent Tag ID | Filter tags by parent tag ID, or set the parent when creating a tag. | 100 | | Tag Name | Filter tags by name (contains match). | LS: | Example Payload for List Tags[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/listTags.json "Download example payload") Loading… *** ### Raw Request[​](#rawrequest "Direct link to Raw Request") Send a raw HTTP request to the Qualys API. Select the API plane (Gateway or Classic) since they differ in host, authentication, and content type. | **key: rawRequest** | Input | Notes | Example | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------- | | Connection | The Qualys connection to use. | | | Data | The HTTP body payload to send to the URL. | {"exampleKey": "Example Data"} | | File Data | File Data to be sent as a multipart form upload. | \[{key: "example.txt", value: "My File Contents"}] | | File Data File Names | File names to apply to the file data inputs. Keys must match the file data keys above. | | | Form Data | The Form Data to be sent as a multipart form upload. | \[{"key": "Example Key", "value": new Buffer("Hello World")}] | | Header | A list of headers to send with the request. | User-Agent: curl/7.64.1 | | Max Retry Count | The maximum number of retries to attempt. Specify 0 for no retries. | 0 | | Method | The HTTP method to use. | | | API Plane | Select which Qualys API plane to send the request to. Gateway uses JWT auth and JSON. Classic uses Basic auth with X-Requested-With and may return XML. | | | Query Parameter | A list of query parameters to send with the request. This is the portion at the end of the URL similar to ?key1=value1\&key2=value2. | | | Response Type | The type of data you expect in the response. You can request json, text, or binary data. | json | | Retry On All Errors | If true, retries on all erroneous responses regardless of type. This is helpful when retrying after HTTP 429 or other 3xx or 4xx errors. Otherwise, only retries on HTTP 5xx and network errors. | false | | Retry Delay (ms) | The delay in milliseconds between retries. This is used when 'Use Exponential Backoff' is disabled. | 0 | | Timeout | The maximum time that a client will await a response to its request | 2000 | | URL | Input the path only (e.g., /rest/2.0/search/am/asset). The base URL is determined by the selected API plane. | /rest/2.0/search/am/asset | | Use Exponential Backoff | Specifies whether to use a pre-defined exponential backoff strategy for retries. When enabled, 'Retry Delay (ms)' is ignored. | false | Example Payload for Raw Request[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/rawRequest.json "Download example payload") Loading… *** ### Sync Asset[​](#syncasset "Direct link to Sync Asset") Import third-party assets into Qualys by pushing data through the Gateway connector sync endpoint. Provide the connector metadata (including the Connector UUID from the Qualys Connectors UI) and an array of asset objects with identity and core attributes. Qualys runs identification rules to match or create each asset. | **key: syncAsset** | Input | Notes | Example | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- | | Asset Data | JSON array of asset objects to push to Qualys. Each object should contain identityAttributes (hostName, ipAddress, macAddress, serialNumber, etc.) and coreAttributes (address, biosInfo, softwares, networkInterfaces, etc.). | See Example | | Connection | The Qualys connection to use. | | | Connector Metadata | Connector identifier, source, request tracking, and asset count details. | | Example Payload for Sync Asset[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/syncAsset.json "Download example payload") Loading… *** ### Update Asset Tags[​](#updateassettags "Direct link to Update Asset Tags") Add or remove tags on an asset. Consolidates assign and remove into one action. Static tags only — Qualys rejects dynamic tags. When changing a value-bearing tag (e.g., LS:DomainRole=X), remove the old tag before adding the new one to avoid stale entries. | **key: updateAssetTags** | Input | Notes | Example | | -------------- | ------------------------------------------------------------------------------- | ------- | | Asset ID | The unique identifier for the asset in Qualys. | 12345 | | Connection | The Qualys connection to use. | | | Tags to Add | Tag IDs to assign to the asset. Static tags only — Qualys rejects dynamic tags. | | | Tags to Remove | Tag IDs to remove from the asset. | 100 | Example Payload for Update Asset Tags[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/updateAssetTags.json "Download example payload") Loading… *** ### Update Tag[​](#updatetag "Direct link to Update Tag") Update an existing tag in Qualys. This is a partial update — only provided fields are changed; omitted fields are left untouched. | **key: updateTag** | Input | Notes | Example | | ----------------- | -------------------------------------------------------------------------------------------------------- | ---------------------- | | Color | A hex color code (e.g. #FF5733) used to visually distinguish the tag in the Qualys UI. | #FF5733 | | Connection | The Qualys connection to use. | | | Criticality Score | Tag criticality score (1-5). Qualys derives an asset's criticality as the maximum score across its tags. | 3 | | Tag ID | The unique identifier for the tag. | 12345 | | Tag Name | Updated tag name. Omitted fields are left untouched. | LS:Environment=Staging | Example Payload for Update Tag[⤓](https://prismatic.io/docs/example-payloads/qualys/actions/updateTag.json "Download example payload") Loading… *** ## Changelog[​](#changelog "Direct link to Changelog") ### 2026-08-26[​](#2026-08-26 "Direct link to 2026-08-26") Initial release of Qualys component with VMDR asset management, vulnerability scanning, tag management, and remediation ticket tracking