Connecting to a Qualys asset data source

The Qualys Connected Assets and Risk connector can be run in the platform cluster. The connector incrementally synchronizes the contents of the Qualys asset databases with the data that is managed by the Connected Assets and Risk service.

Before you begin

Collaborate with a Qualys administrator or account owner to obtain login credentials to access the Qualys platform and API. An API/Login credential pair (username and password) can be generated by Manager. For more information, see Qualys User Management (https://qualysguard.qg1.apps.qualys.in/qwebhelp/fo_portal/index.htm#t=user_management.htm).

If you have a firewall between your cluster and the data source target, use the IBM® Security Edge Gateway to host the containers. The Edge Gateway must be version 1.6 or later. For more information, see Setting up Edge Gateway.

About this task

The Qualys connector is designed to work with Qualys version 3.9.1.0-5 by using the Asset Management and VMDR APIs.
  • The Qualys Connected Assets and Risk connector is designed to work with Qualys version 3.9.1.0-5.
  • The following Qualys modules are required by this connector:
    • GAV

Procedure

  1. Log in to IBM Security QRadar® Suite Software.
  2. From the menu, click Connections > Data sources.
  3. On the Integration data sources page, on the Qualys tile, click Set up a connection.
  4. On the Connection services page, select the Connected assets & risk service tile, and then click Enable.
  5. Click Next.
  6. On the Connection details page, configure the following parameters.
    1. Configure the connection to the data source.
      Table 1. Connection parameters
      Parameter Description
      Data source name Enter a unique name to identify the data source connection. You can create multiple connections to a data source, so it is useful to clearly set them apart by name.

      Only alphanumeric characters and the following special characters are allowed: - . _

      Data source description Enter a description to indicate the purpose of the data source connection. You can create multiple connections to a data source, so it is useful to clearly indicate the purpose of each connection by description.

      Only alphanumeric characters and the following special characters are allowed: - . _

      Edge gateway If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway field, specify an Edge Gateway to host the connector.

      It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.

      host Enter the Qualys API Server URL.
      Frequency Select how often the connector imports data from the data source, in minutes. The value must be an integer. For example, a value of 5 causes the connector to run every 5 minutes. If the data source doesn't have many assets, or you don't want to import data often, reduce the frequency.
    2. Click Next.
  7. On the Connection configurations page, configure identity and access.
    1. Click Add a configuration.
    2. In the Configuration details window, configure the following parameters.
      Table 2. Configuration parameters
      Parameter Description
      Configuration Name Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Qualys Gateway Enter the Qualys API Gateway URL. For more information on Qualys platform URLs, see Identify your Qualys platform (https://www.qualys.com/platform-identification/).
      Username Enter the username from Qualys connector.
      Password Enter the password from Qualys credentials.
    3. To save your configuration and establish the connection, click Save.
  8. Click Finish.
  9. To manage your active connections, complete the following steps:
    1. On the Integration data sources page, on the tile of the relevant data source, click Manage <x> of <x> active connections.
    2. On the Connection status page, on the tile of the relevant data source, you can edit, refresh, or delete your data source connection.

Results

The connector imports data from the data source. The connector imports data again at the interval that you set in the Frequency field.

Tip: After you connect a data source, the data retrieval time depends on the selected frequency duration (maximum time set in the cronjob). Before the full data set is returned, the data source is in Contacting Service status. After the data is returned, the data source shows as being connected, and will update the connection status for every cronjob run thereafter.

You can add other connection configurations for this data source that have different users and different data access permissions.

What to do next

Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.

To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.