Skip to main content
qualys icon

Qualys Connector

SourceAPI DocsAPI Docs (CSAM)API ChangelogConnector Changelog

Description​

Qualys is a cloud-based security and compliance platform that provides vulnerability management, asset inventory, and risk scoring through its VMDR (Vulnerability Management, Detection, and Response) solution. This component allows managing assets, tags, VM scans, TruRisk scores, and remediation tickets across the Qualys Gateway and Classic APIs.

API Documentation​

This component was built using the following API references:

Connections​

Basic Authentication​

key: qualys

To authenticate with Qualys, a platform username and password are required along with the API base URLs for the account's assigned pod.

Prerequisites​

  • A Qualys subscription with API access enabled
  • A user account with the appropriate role (e.g., Manager, Unit Manager, or Reader depending on the actions used)
  • The Gateway and Classic API base URLs for the assigned Qualys platform pod

Setup Steps​

  1. Log in to the Qualys platform
  2. Confirm that API access is enabled for the account. API access is controlled by the Qualys subscription administrator
  3. Identify the platform pod by visiting the Platform Identification page. Each pod has distinct Gateway and Classic API base URLs
  4. Note the Gateway API URL (e.g., https://gateway.qg1.apps.qualys.com) and the Classic API URL (e.g., https://qualysapi.qg1.apps.qualys.com) for the assigned pod

Configure the Connection​

  • Enter the Username for the Qualys platform account
  • Enter the Password for that account
  • Enter the Gateway API URL, the base URL for the Qualys Gateway (CSAM/GAV) API on the assigned pod
  • Enter the Classic API URL, the base URL for the Qualys Classic (VM/PC) API on the assigned pod
InputNotesExample
Classic API URL

Base URL for the Qualys Classic (VM/PC) API. Find the pod URL at Platform Identification.

https://qualysapi.qg1.apps.qualys.com
Gateway API URL

Base URL for the Qualys Gateway (CSAM/GAV) API. Find the pod URL at Platform Identification.

https://gateway.qg1.apps.qualys.com
Password

Qualys platform password.

s3cur3P@ss
Username

Qualys platform username.

qualys-api-user

Triggers​

Changed Assets​

Checks for assets that have changed since the last execution on a configured schedule. Uses the Gateway asset search with a last-modified filter and persists the watermark via polling state. Note: echo suppression is NOT built into this trigger. If the flow pushes assets back to Qualys, those writes will re-appear as changes on the next poll. Implement echo suppression at the flow level using outbound push timestamps. | key: changedAssets

InputNotesExample
Connection

The Qualys connection to use.

Show New Records

When enabled, assets created since the last poll are included in the trigger output.

true
Show Updated Records

When enabled, assets modified since the last poll are included in the trigger output.

true

This trigger polls the Qualys Gateway asset search API for assets that have been modified since the last recurrence.

How It Works​

  1. The trigger runs on the configured schedule (e.g., every 5 minutes)
  2. It queries the Gateway API for assets modified since the last recurrence using the assetLastUpdated filter
  3. Results are paginated automatically using keyset cursor pagination, collecting all matching assets across pages
  4. If the API returns HTTP 416 (page size exceeds available results), the page size is halved and the request is retried
  5. The trigger persists the poll timestamp via polling state so the next execution picks up where it left off

Batching

Batching is enabled per flow on this trigger. Once enabled, each changed record is dispatched as its own execution, or grouped by the configured batch size. Batch size and the number of batches dispatched concurrently can both be overridden per instance. Raising concurrency increases the request volume sent to Qualys.

To turn it on, select the flow's trigger, open the Flow control tab, and switch on Enable Batching. Under Batch Size, keep Trigger default to use the size this trigger ships with, or choose Custom batch size to set a specific size. Batch Concurrency is optional; leave it blank for no batch-level limit.

With batching off, a downstream step reads changed assets from payload.body.data.createdRecords and payload.body.data.updatedRecords. With batching on, the trigger resolver flattens both arrays into individual asset items, and those object paths do not exist. Any step that reads the unbatched shape must be updated before batching is enabled. Because batching is enabled per flow, the change is scoped to that flow rather than to the component or to other flows using the same trigger.

Returned Data​

The trigger returns an object with two arrays. Each asset is placed in createdRecords or updatedRecords by comparing its createdDate against the minute-truncated watermark from the previous recurrence, and the Show New Records and Show Updated Records toggles control which arrays are populated.

The first recurrence seeds the watermark at the current timestamp and returns only assets changed at or after that point, with no historical backfill. Change detection proceeds from there.

Example Response
{
  "data": {
    "createdRecords": [
      {
        "assetId": 1225180002,
        "assetUUID": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "assetType": "HOST",
        "assetName": "Server02.example.com",
        "dnsName": "server02.example.com",
        "fqdn": "server02.example.com",
        "netbiosName": "SERVER02",
        "address": "10.0.1.60",
        "operatingSystem": {
          "osName": "Microsoft Windows Server 2016 Standard 10.0.14393 64-bit N/A Build 14393",
          "category": "Windows / Server",
          "productName": "Windows Server 2016",
          "publisher": "Microsoft"
        },
        "createdDate": "2026-08-18T02:41:05.000Z",
        "lastModifiedDate": "2026-08-18T02:41:05.000Z"
      }
    ],
    "updatedRecords": [
      {
        "assetId": 1225180001,
        "assetUUID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "assetType": "HOST",
        "assetName": "Server01.example.com",
        "dnsName": "server01.example.com",
        "fqdn": "server01.example.com",
        "netbiosName": "SERVER01",
        "address": "10.0.1.60",
        "operatingSystem": {
          "osName": "Microsoft Windows Server 2016 Standard 10.0.14393 64-bit N/A Build 14393",
          "category": "Windows / Server",
          "productName": "Windows Server 2016",
          "publisher": "Microsoft"
        },
        "createdDate": "2026-08-11T07:28:23.000Z",
        "lastModifiedDate": "2026-08-18T02:42:33.000Z"
      }
    ]
  }
}

Fields shown are representative. The full response object includes additional properties.

Notes​

  • Echo suppression is NOT built into this trigger. If the flow pushes assets back to Qualys, those writes will re-appear as changes on the next poll. Implement echo suppression at the flow level using outbound push timestamps.
Example Payload for Changed Assets⤓
Loading…

Data Sources​

Select Asset Group​

Fetch asset groups from Qualys for use in dropdown selectors (e.g., scan targeting). | key: selectAssetGroup | type: picklist

InputNotesExample
Connection

The Qualys connection to use.

Example Payload for Select Asset Group⤓
Loading…

Select Scanner Appliance​

Fetch scanner appliances from Qualys for use in dropdown selectors. Required when launching a VM scan against targets not covered by Cloud Agent. | key: selectScannerAppliance | type: picklist

InputNotesExample
Connection

The Qualys connection to use.

Example Payload for Select Scanner Appliance⤓
Loading…

Select Tag​

Fetch tags from Qualys for use in dropdown selectors. | key: selectTag | type: picklist

InputNotesExample
Connection

The Qualys connection to use.

Static Only

When true, only return static tags (excludes dynamic tags with a rule type).

false
Example Payload for Select Tag⤓
Loading…

Actions​

Create Tag​

Create a new tag in Qualys using the Asset Management & Tagging (QPS) API. | key: createTag

InputNotesExample
Color

A hex color code (e.g. #FF5733) used to visually distinguish the tag in the Qualys UI.

#FF5733
Connection

The Qualys connection to use.

Criticality Score

Tag criticality score (1-5). Qualys derives an asset's criticality as the maximum score across its tags.

3
Parent Tag ID

Filter tags by parent tag ID, or set the parent when creating a tag.

100
Rule Text

Tag rule expression. Required for dynamic rule types (GROOVY, OS_REGEX, etc.).

Windows.*Server
Rule Type

Tag rule type (e.g., STATIC, GROOVY, OS_REGEX, NETWORK_RANGE).

STATIC
Tag Name

A descriptive label for the tag, such as 'LS:Environment=Production'.

LS:Environment=Production
Example Payload for Create Tag⤓
Loading…

Delete Remediation Tickets​

Bulk-delete remediation tickets by filter. Defaults to dry-run mode — set Dry Run to false to perform the actual deletion. Up to 20,000 tickets per call. Requires Manager or Unit Manager role. There is no undo. | key: deleteRemediationTickets

InputNotesExample
Assignee

Filter tickets assigned to this user's email address.

user@example.com
Connection

The Qualys connection to use.

Dry Run

When true (default), returns the tickets that would be deleted without actually deleting them. Set to false to perform the deletion. There is no undo.

true
Severity

Filter tickets by vulnerability severity (1-5).

4
Ticket Numbers

Specific ticket numbers to retrieve or act on.

12345
Ticket State

Filter tickets by their current workflow state.

OPEN
Example Payload for Delete Remediation Tickets⤓
Loading…

Edit Remediation Tickets​

Bulk-edit remediation tickets: reassign, change state, or add comments. Up to 20,000 tickets per call. Requires Manager or Unit Manager role — Scanner or Reader credentials silently fail to act on tickets outside the caller's own account. | key: editRemediationTickets

InputNotesExample
Comment

Add a comment to the selected tickets.

Patch applied, awaiting verification.
Connection

The Qualys connection to use.

New Assignee

Reassign selected tickets to this user.

user@example.com
New State

Change the state of selected tickets. A Closed/Fixed or Closed/Ignored ticket cannot be changed to Resolved.

OPEN
Ticket Numbers

Specific ticket numbers to retrieve or act on.

12345
Example Payload for Edit Remediation Tickets⤓
Loading…

Get Asset​

Retrieve a single asset by ID from the Qualys inventory using the Gateway asset search API. | key: getAsset

InputNotesExample
Asset ID

The unique identifier for the asset in Qualys.

12345
Connection

The Qualys connection to use.

Example Payload for Get Asset⤓
Loading…

Get Remediation Ticket Info​

Retrieve detailed information for specific remediation tickets by ticket number or by last-modified timestamp. | key: getRemediationTicketInfo

InputNotesExample
Connection

The Qualys connection to use.

Since

Return tickets updated on or after this date/time. Format: YYYY-MM-DDTHH:MM:SSZ.

2024-01-01T00:00:00Z
Ticket Numbers

Specific ticket numbers to retrieve or act on.

12345
Example Payload for Get Remediation Ticket Info⤓
Loading…

Launch VM Scan​

Launch a vulnerability management scan against asset groups or tags. Asynchronous — returns a scan reference immediately, not results. Use List Scans to track status. Requires an existing scan option profile and at least one online scanner appliance or Cloud Agent scoped to the targets. | key: launchScan

InputNotesExample
Asset Group IDs

Asset group IDs identifying the assets to scan.

54321
Connection

The Qualys connection to use.

Option Profile ID

ID of the scan option profile to use. Select from the Option Profile data source.

12345
Scanner Appliance

Name or ID of the scanner appliance. Required when targets are not covered by Cloud Agent.

Scan Title

A descriptive name to identify the scan in Qualys.

Weekly Vulnerability Scan
Target Tag IDs

Tag IDs identifying the assets to scan.

12345
Example Payload for Launch VM Scan⤓
Loading…

List Asset Risk Data​

Retrieve TruRisk scores, vulnerability counts, and derived risk bands from the Classic VM host list API. This is the only source for TruRisk data — the modern Gateway asset API does not return vulnerability information. Returns the VM (Classic) TruRisk score, not the CSAM figure. | key: listAssetRiskData

InputNotesExample
Connection

The Qualys connection to use.

Fetch All

When true, automatically fetches all pages of results.

false
Page Size

The maximum number of results to return per page. The API default applies when omitted.

100
Example Payload for List Asset Risk Data⤓
Loading…

List Assets​

Search for assets in the Qualys inventory using the Gateway asset search API. Supports keyset cursor pagination and field selection. | key: listAssets

InputNotesExample
Connection

The Qualys connection to use.

Exclude Fields

Field names to omit from the response payload, reducing response size.

Fetch All

When true, automatically fetches all pages of results.

false
Include Fields

Fields to include in the response. When set, only these fields are returned.

Last Modified Since

Filter assets modified after this date/time (ISO 8601). Used as an incremental sync watermark.

2024-01-01T00:00:00Z
Pagination

Page size and cursor controls for keyset pagination.

Example Payload for List Assets⤓
Loading…

List Remediation Tickets​

List remediation tickets from the Classic API. Maximum 1,000 tickets per call — the API truncates silently beyond that limit. The response includes a truncation flag so callers can detect incomplete results. | key: listRemediationTickets

InputNotesExample
Assignee

Filter tickets assigned to this user's email address.

user@example.com
Connection

The Qualys connection to use.

Modified Since

Return tickets modified on or after this date/time. Format: YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ.

2024-01-01
Severity

Filter tickets by vulnerability severity (1-5).

4
Ticket State

Filter tickets by their current workflow state.

OPEN
Example Payload for List Remediation Tickets⤓
Loading…

List Scans​

List VM scans from the Classic API. This is the only way to check a launched scan's status — there is no dedicated status endpoint. | key: listScans

InputNotesExample
Connection

The Qualys connection to use.

Launched After

Filter scans launched after this date (YYYY-MM-DD).

2024-01-01
Scan Reference

Filter scans by reference ID (e.g., scan/1234567890.12345).

scan/1234567890.12345
Scan State

Filter scans by execution state. Use Running to find active scans.

Running
Example Payload for List Scans⤓
Loading…

List Tags​

Search for tags in Qualys using the Asset Management & Tagging (QPS) API. | key: listTags

InputNotesExample
Connection

The Qualys connection to use.

Fetch All

When true, automatically fetches all pages of results.

false
Page Size

The maximum number of results to return per page. The API default applies when omitted.

100
Parent Tag ID

Filter tags by parent tag ID, or set the parent when creating a tag.

100
Tag Name

Filter tags by name (contains match).

LS:
Example Payload for List Tags⤓
Loading…

Raw Request​

Send a raw HTTP request to the Qualys API. Select the API plane (Gateway or Classic) since they differ in host, authentication, and content type. | key: rawRequest

InputNotesExample
Connection

The Qualys connection to use.

Data

The HTTP body payload to send to the URL.

{"exampleKey": "Example Data"}
File Data

File Data to be sent as a multipart form upload.

[{key: "example.txt", value: "My File Contents"}]
File Data File Names

File names to apply to the file data inputs. Keys must match the file data keys above.

Form Data

The Form Data to be sent as a multipart form upload.

[{"key": "Example Key", "value": new Buffer("Hello World")}]
Header

A list of headers to send with the request.

User-Agent: curl/7.64.1
Max Retry Count

The maximum number of retries to attempt. Specify 0 for no retries.

0
Method

The HTTP method to use.

API Plane

Select which Qualys API plane to send the request to. Gateway uses JWT auth and JSON. Classic uses Basic auth with X-Requested-With and may return XML.

Query Parameter

A list of query parameters to send with the request. This is the portion at the end of the URL similar to ?key1=value1&key2=value2.

Response Type

The type of data you expect in the response. You can request json, text, or binary data.

json
Retry On All Errors

If true, retries on all erroneous responses regardless of type. This is helpful when retrying after HTTP 429 or other 3xx or 4xx errors. Otherwise, only retries on HTTP 5xx and network errors.

false
Retry Delay (ms)

The delay in milliseconds between retries. This is used when 'Use Exponential Backoff' is disabled.

0
Timeout

The maximum time that a client will await a response to its request

2000
URL

Input the path only (e.g., /rest/2.0/search/am/asset). The base URL is determined by the selected API plane.

/rest/2.0/search/am/asset
Use Exponential Backoff

Specifies whether to use a pre-defined exponential backoff strategy for retries. When enabled, 'Retry Delay (ms)' is ignored.

false
Example Payload for Raw Request⤓
Loading…

Sync Asset​

Import third-party assets into Qualys by pushing data through the Gateway connector sync endpoint. Provide the connector metadata (including the Connector UUID from the Qualys Connectors UI) and an array of asset objects with identity and core attributes. Qualys runs identification rules to match or create each asset. | key: syncAsset

InputNotesExample
Asset Data

JSON array of asset objects to push to Qualys. Each object should contain identityAttributes (hostName, ipAddress, macAddress, serialNumber, etc.) and coreAttributes (address, biosInfo, softwares, networkInterfaces, etc.).

[
  {
    "identityAttributes": {
      "hostName": "web-server-01",
      "ipAddress": [
        "10.0.1.50"
      ],
      "sourceNativeKey": "asset-001"
    },
    "coreAttributes": {
      "hostName": "web-server-01",
      "address": "10.0.1.50",
      "operatingSystem": "Ubuntu 22.04",
      "sourceLastUpdatedDate": 1700000000000,
      "sourceCreatedDate": 1700000000000
    }
  }
]
Connection

The Qualys connection to use.

Connector Metadata

Connector identifier, source, request tracking, and asset count details.

Example Payload for Sync Asset⤓
Loading…

Update Asset Tags​

Add or remove tags on an asset. Consolidates assign and remove into one action. Static tags only — Qualys rejects dynamic tags. When changing a value-bearing tag (e.g., LS:DomainRole=X), remove the old tag before adding the new one to avoid stale entries. | key: updateAssetTags

InputNotesExample
Asset ID

The unique identifier for the asset in Qualys.

12345
Connection

The Qualys connection to use.

Tags to Add

Tag IDs to assign to the asset. Static tags only — Qualys rejects dynamic tags.

Tags to Remove

Tag IDs to remove from the asset.

100
Example Payload for Update Asset Tags⤓
Loading…

Update Tag​

Update an existing tag in Qualys. This is a partial update — only provided fields are changed; omitted fields are left untouched. | key: updateTag

InputNotesExample
Color

A hex color code (e.g. #FF5733) used to visually distinguish the tag in the Qualys UI.

#FF5733
Connection

The Qualys connection to use.

Criticality Score

Tag criticality score (1-5). Qualys derives an asset's criticality as the maximum score across its tags.

3
Tag ID

The unique identifier for the tag.

12345
Tag Name

Updated tag name. Omitted fields are left untouched.

LS:Environment=Staging
Example Payload for Update Tag⤓
Loading…

Changelog​

2026-08-26​

Initial release of Qualys component with VMDR asset management, vulnerability scanning, tag management, and remediation ticket tracking