Skip to main content

Connect Qualys

Use this guide to import Qualys vulnerability findings and, with a scan-capable role, trigger scans from Cracken.

Prerequisites​

  • Access to the Qualys Vulnerability Management module
  • Permission to create and activate a Qualys user
  • The API base URL for your Qualys platform (an https:// URL)
  • At least one writable Cracken realm: either a realm you created or a published realm you manage. Cracken selects one of your writable realms as the import destination when you first connect Qualys.

Prepare the user and settings​

For read-only vulnerability import, create a dedicated user with:

  • Reader role
  • GUI and API access so the account can be activated and then used through the API
  • Manage VM module enabled
  • Every Business Unit and Asset Group that Cracken should read

Keep two-factor authentication enabled for GUI access; API authentication continues to use the account's username and password. Activate the account through the email Qualys sends and sign in once. In Vulnerability Management → Reports → Setup → CVSS, enable CVSS scoring.

The Reader role cannot launch scans. If Cracken must trigger scans, grant a dedicated, Scanner-capable role scoped to only the required asset groups.

Record the username, password, and the platform's API URL. Use the API URL for your Qualys platform, not the browser login URL. The URL must start with https://; Cracken rejects plain http:// endpoints because the connection carries your Qualys credentials on every request.

Connect Qualys​

  1. Open Integration Center → Data Integrations.
  2. On the Qualys card, click Install.
  3. Enter the Username, Password, and API URL (https:// only).
  4. Click Test Connection, then Save & Connect.

Cracken can list vulnerabilities within a Reader's asset scope. It can trigger scans only when the configured account has a Scanner-capable role for those assets.

Automatic import​

While Qualys is connected and its destination remains writable, Cracken imports vulnerability findings into that realm's Cybergraph automatically on a recurring schedule. You do not need to fetch or add findings by hand for them to appear. The Vulnerability Findings tab remains available for reviewing findings on demand and adding selected ones immediately.

The Vulnerability Findings tab names the destination realm and shows when the last automatic import ran or whether it failed. Saving new credentials keeps the same destination. If that realm is archived or removed, fetching remains available but automatic and manual imports stop. Remove and reconnect Qualys after creating or publishing a writable realm to select a new destination.

Sources​

Next steps​

  • Data Integrations — Review how connected security data flows into Cracken.
  • Cybergraph — See how Cracken uses imported vulnerability data.