> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-qualys.md).

# Integrate Prisma Cloud with Qualys

Learn how to integrate Prisma® Cloud with Qualys.

Prisma® Cloud integrates with the Qualys platform to ingest and visualize host vulnerability data for your resources that are deployed on the AWS, Azure, and GCP cloud platforms.

1. Gather the information that you need to set up Qualys integration on Prisma Cloud.
   * Make sure to add [Prisma Cloud NAT Gateway IP Addresses](/content-collections/get-started/console-prerequisites.md#idcb6d3cd4-d1bf-450a-b0ec-41c23a4d4280) to the firewall so Qualys can accept traffic and prevent incoming requests from being blocked.
   * You must obtain the Qualys Security Operations Center (SOC) server API URL (also known as or associated with a POD—the point of delivery to which you are assigned and connected for access to Qualys).

     Get the API URL from your Qualys account (**Help > About**). The Qualys API URL is listed under **Qualys Scanner Appliances**.

     <figure><img src="/files/pZnGbQaPdQ3IGsdeCtNc" alt="qualys azure api server url"><figcaption></figcaption></figure>
   * You must provide Qualys users with the privileges required to enable the integration using the Manager role, the Unit Manager role, or both. You can modify the Manager role to enable read-only access permission if needed. (Refer to the Qualys documentation for details about [User Roles Comparison (Vulnerability Management)](https://qualysguard.qualys.com/qwebhelp/fo_portal/user_accounts/user_roles_comparison_vm.htm).)
   * You must enable Vulnerability Management (VM), Cloud Agent (CA), and Asset View (AV) for Qualys users.
   * You must enable Qualys API and Qualys EC2 API access for Qualys users.

     If you have trouble connecting with Qualys API, you can use the CLI to confirm if API access is available for your account. Replace the username, password, and URL for the Qualys service in the following cURL examples with your credentials to verify the connectivity:

     ```
     curl -H “X-Requested-With: Curl Sample” -u “Username:Password” “https://qualysapi.qg1.apps.qualys.in/api/2.0/fo/scan/?action=list&echo_request=1”

     curl -k “https://qualysapi.qg1.apps.qualys.in/msp/asset_group_list.php” -u “Username:Password”

     curl -k -H “X-Requested-With:curl” “https://qualysapi.qg1.apps.qualys.in/api/2.0/fo/scan/stats/?action=list” -u “Username:Password”
     ```
   * You must configure Qualys Sensors for AWS cloud, such as Virtual Scanner Appliances, Cloud Agents, AWS Cloud Connectors, and Internet Scanners. The cloud agents or cloud connectors enable Prisma Cloud to retrieve vulnerability data so that you can correlate this data with your AWS asset inventory. (Refer to the [Qualys documentation](https://qualysguard.qg2.apps.qualys.com/qwebhelp/fo_portal/scans/win_launch_ec2_scan.htm) for more information.)
   * For Azure accounts, deploy the Qualys Virtual Scanner Appliance using Microsoft Azure Resource Manager (ARM) (see the [Qualys documentation](https://community.qualys.com/docs/DOC-5725-scanning-in-microsoft-azure-using-resource-manager-arm#group)). You can use Qualys Cloud Agents (Windows and Linux) for Azure instances from the Azure Security Center console to view vulnerability assessment findings within Azure Security Center and your Qualys subscription (see [Qualys Documentation](https://cdn2.qualys.com/docs/qualys-securing-azure-with-qualys.pdf).)
   * Make sure that **Azure VM Information** is visible in Qualys.

     <figure><img src="/files/xpQpxti3SdEMBdO94mpJ" alt="qualys azure vm info"><figcaption></figcaption></figure>
   * For GCP, you must install Cloud Agents on GCP VM instances. For more information, see Deploying Qualys Cloud Agent from Google Cloud Console topic in [Qualys Documentation](https://cdn2.qualys.com/docs/qualys-securing-google-cloud-platform.pdf).
2. Set up Qualys Integration on Prisma Cloud.
   1. Login to Prisma Cloud.
   2. Select **Settings > Integrations & Notifications > Integrations**.
   3. Select **Add Integration > Qualys** from the list.
   4. Enter an **Integration Name** and **Description**.
   5. Enter the **Qualys API Server URL (without http\[s])**.

      This is the **API URL** for your Qualys account.

      (tt:\[NOTE]) When you enter this URL, do not include (http(s)) or the port (:443). For example, enter only **qualysapi.qg1.apps.qualys.in**.
   6. Enter your Qualys **User Login** and **Password**.

      <figure><img src="/files/5QqYGanGotR3AzywMtON" alt="qualys int 1"><figcaption></figcaption></figure>
   7. Click **Next**, review the **Summary**, and then **Test Integration**.

      <figure><img src="/files/qKzdsiNRuH7i65dp3vvA" alt="qualys int 2"><figcaption></figcaption></figure>
   8. **Save Integration** after the testing is successful.

      <figure><img src="/files/MT1YuVzfKCAvi64tFATW" alt="qualys int 3"><figcaption></figcaption></figure>
   9. The integration will be listed on the **Integrations** page, where you can **View**, **Edit**, or **Delete** the integration from the **Actions** panel.

      <figure><img src="/files/y74XBpvKHoHrHkw3GZLx" alt="qualys int 4"><figcaption></figcaption></figure>
3. View Qualys host vulnerability data in Prisma Cloud.

   After you configure Prisma Cloud with access to the Qualys findings, you can use RQL queries for visibility into the host vulnerability information collected by Qualys.

   1. Navigate to **Investigate > Search** page.
   2. To search for **Config Query**, enter the following RQL query.

      ```
      config from cloud.resource where finding.type = 'Host Vulnerability' AND finding.source = 'Qualys'
      ```

      The query returns a list of affected assets for further investigation. Select an asset to view the **Finding Types** side panel. The panel lists threats or security issues associated with the asset.

      1. Select **Vulnerability** to see information related to host vulnerabilities.

         <figure><img src="/files/aR3qYtbaExYUrtzOqoL7" alt="qualys host vulnerability"><figcaption></figcaption></figure>
      2. Select **Audit Trail** to see the CVE numbers.

         <figure><img src="/files/r1jMYWWB3jUbbYIbj9gF" alt="qualys audit trail"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-qualys.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.