Integrate Prisma Cloud with Qualys

Learn how to integrate Prisma® Cloud with Qualys.

Prisma® Cloud integrates with the Qualys platform to ingest and visualize host vulnerability data for your resources that are deployed on the AWS, Azure, and GCP cloud platforms.

Gather the information that you need to set up Qualys integration on Prisma Cloud.
- Make sure to add Prisma Cloud NAT Gateway IP Addresses to the firewall so Qualys can accept traffic and prevent incoming requests from being blocked.
- You must obtain the Qualys Security Operations Center (SOC) server API URL (also known as or associated with a POD—the point of delivery to which you are assigned and connected for access to Qualys).
  Get the API URL from your Qualys account (Help > About). The Qualys API URL is listed under Qualys Scanner Appliances.
- You must provide Qualys users with the privileges required to enable the integration using the Manager role, the Unit Manager role, or both. You can modify the Manager role to enable read-only access permission if needed. (Refer to the Qualys documentation for details about User Roles Comparison (Vulnerability Management).)
- You must enable Vulnerability Management (VM), Cloud Agent (CA), and Asset View (AV) for Qualys users.
- You must enable Qualys API and Qualys EC2 API access for Qualys users.
  If you have trouble connecting with Qualys API, you can use the CLI to confirm if API access is available for your account. Replace the username, password, and URL for the Qualys service in the following cURL examples with your credentials to verify the connectivity:
  curl -H “X-Requested-With: Curl Sample” -u “Username:Password” “https://qualysapi.qg1.apps.qualys.in/api/2.0/fo/scan/?action=list&echo_request=1” curl -k “https://qualysapi.qg1.apps.qualys.in/msp/asset_group_list.php” -u “Username:Password” curl -k -H “X-Requested-With:curl” “https://qualysapi.qg1.apps.qualys.in/api/2.0/fo/scan/stats/?action=list” -u “Username:Password”
- You must configure Qualys Sensors for AWS cloud, such as Virtual Scanner Appliances, Cloud Agents, AWS Cloud Connectors, and Internet Scanners. The cloud agents or cloud connectors enable Prisma Cloud to retrieve vulnerability data so that you can correlate this data with your AWS asset inventory. (Refer to the Qualys documentation for more information.)
- For Azure accounts, deploy the Qualys Virtual Scanner Appliance using Microsoft Azure Resource Manager (ARM) (see the Qualys documentation). You can use Qualys Cloud Agents (Windows and Linux) for Azure instances from the Azure Security Center console to view vulnerability assessment findings within Azure Security Center and your Qualys subscription (see Qualys Documentation.)
- Make sure that Azure VM Information is visible in Qualys.
- For GCP, you must install Cloud Agents on GCP VM instances. For more information, see Deploying Qualys Cloud Agent from Google Cloud Console topic in Qualys Documentation.
Set up Qualys Integration on Prisma Cloud.
1. Login to Prisma Cloud.
2. Select Settings > Integrations & Notifications > Integrations.
3. Select Add Integration > Qualys from the list.
4. Enter an Integration Name and Description.
5. Enter the Qualys API Server URL (without http[s]).
  This is the API URL for your Qualys account.
  (tt:[NOTE]) When you enter this URL, do not include (http(s)) or the port (:443). For example, enter only qualysapi.qg1.apps.qualys.in.
6. Enter your Qualys User Login and Password.
7. Click Next, review the Summary, and then Test Integration.
8. Save Integration after the testing is successful.
9. The integration will be listed on the Integrations page, where you can View, Edit, or Delete the integration from the Actions panel.
View Qualys host vulnerability data in Prisma Cloud.
After you configure Prisma Cloud with access to the Qualys findings, you can use RQL queries for visibility into the host vulnerability information collected by Qualys.
1. Navigate to Investigate > Search page.
2. To search for Config Query, enter the following RQL query.
  config from cloud.resource where finding.type = 'Host Vulnerability' AND finding.source = 'Qualys'
  The query returns a list of affected assets for further investigation. Select an asset to view the Finding Types side panel. The panel lists threats or security issues associated with the asset.
  1. Select Vulnerability to see information related to host vulnerabilities.
  2. Select Audit Trail to see the CVE numbers.