What Is Qualys?
Qualys is a Cloud-based Security and Compliance Platform that offers services like:
Vulnerability Management (VMDR)
Patch Management
Web Application Scanning (WAS)
Asset Inventory
Compliance Monitoring
Policy Compliance
Core Concepts of Qualys
1. Qualys Cloud Platform
Central platform where you can launch and manage modules.
All modules (like VMDR, WAS, etc.) are integrated.
Accessible through Qualys Cloud Console (web UI).
Modules in Qualys
| Module | Purpose |
| -------------------- | -------------------------------------------------------- |
| VMDR | Vulnerability Management, Detection, and Response |
| AssetView | Real-time asset inventory |
| WAS | Web Application Scanning for OWASP Top 10 |
| PC | Policy Compliance (for internal policies and benchmarks) |
| SCA | Security Configuration Assessment |
| Patch Management | Automates patching of systems |
| Multi-Vector EDR | Endpoint Detection & Response |
| FIM | File Integrity Monitoring |
. Key Components
✅ Assets
Devices (servers, laptops, containers, etc.) discovered and monitored.
✅ Scanners
External Scanner – Used to scan public IPs/web apps.
Internal Scanner – Installed inside private networks.
Cloud Agent – Lightweight agent on assets for continuous scanning.
✅ Cloud Agent
Installed on endpoints.
Sends data to the Qualys Cloud Platform.
Useful for laptops/remote systems outside the network.
✅ Sensor Types
Scanner Appliance
Cloud Agents
Passive Sensor
Virtual Scanner Appliance (for AWS, Azure, VMware)
What Are Sensors in Qualys?
Sensors are agents or appliances that collect data from your environment and send
it to the Qualys Cloud Platform for processing and analysis.
| Sensor Type | Description
| **Cloud Agents** | Lightweight agents installed on endpoints (laptops,
servers) to continuously collect vulnerability, inventory, and compliance data.
|
| **Scanner Appliances** | Network-based scanners that can scan IP ranges in your
internal or external networks. Used for authenticated and unauthenticated scans. |
| **Passive Sensor** | A network tap or SPAN port–based sensor that listens to
network traffic to discover unmanaged devices and activities in real time. |
| **Container Sensor** | Deployed within a container environment (like Docker or
Kubernetes) to scan container images and running containers. |
| **Virtual Appliances** | Scanner appliances that can be deployed in virtual
environments like **VMware**, **AWS**, **Azure**, **GCP**.
|
| **Cloud Connectors** | Collect metadata from public cloud providers (AWS,
Azure, GCP) using APIs to detect cloud assets and configurations.
|
Working with VMDR (Vulnerability Management)
Step-by-step Flow:
Asset Discovery
Use Cloud Agent or Scanner to detect systems.
Scan Launch
Start vulnerability scans on selected IPs.
Scan Results
View detected vulnerabilities: severity, CVEs, patches.
Remediation
Use built-in Patch Management or notify system owners.
Reports
Generate compliance, risk, and remediation reports.
Common Use Cases
Discover all assets in the cloud and on-prem
Detect software vulnerabilities (CVEs)
Check for misconfigured systems
Comply with benchmarks like CIS, NIST
Scan web applications for XSS, SQLi
Automate patching
Integrations
SIEM Tools (Splunk, QRadar)
Ticketing Systems (ServiceNow)
Cloud Platforms (AWS, Azure, GCP)
CI/CD tools (Jenkins, Ansible)
Interview Questions (Beginner)
1. What is Qualys used for?
Qualys is a cloud-based security platform used for vulnerability management,
compliance monitoring, and asset inventory. It helps identify security issues and
misconfigurations in IT environments.
2. What is the difference between a Cloud Agent and Scanner?
Cloud Agent: Installed on a machine (host), continuously collects data and sends it
to Qualys.
Scanner Appliance: A virtual or physical scanner deployed to scan internal or
external networks actively
3. What are the main modules of Qualys?
Some major modules include:
VMDR (Vulnerability Management, Detection, and Response)
WAS (Web Application Scanning)
PC (Policy Compliance)
AssetView
Threat Protection
Patch Management
4. How do you scan internal vs external assets?
Internal Scan: Use an internal scanner appliance or cloud agent inside your
network.
External Scan: Use Qualys cloud scanners or appliances configured on the DMZ.
5. How does Qualys help in vulnerability remediation?
It detects vulnerabilities, prioritizes them using Threat Intelligence + CVSS
scores, and integrates with patch management tools to automate or assist in fixing
issues.
6. What is VMDR?
VMDR stands for Vulnerability Management, Detection, and Response. It is an all-in-
one solution that:
Discovers assets
Scans for vulnerabilities
Prioritizes based on risk
Suggests remediation
7. Can Qualys detect zero-day vulnerabilities?
Not directly. Qualys detects known vulnerabilities. However, it can detect
suspicious behavior, outdated software, or misconfigurations that may indicate a
zero-day vulnerability. It updates signatures regularly based on vendor
disclosures.
8. What’s the difference between WAS and VMDR?
| Feature | WAS (Web App Scanning) | VMDR
|
| ------- | ------------------------------------------------- |
------------------------------------- |
| Focus | Web application vulnerabilities (e.g., XSS, SQLi) | OS, software,
network vulnerabilities |
| Targets | Web apps and APIs | Servers, desktops,
network devices |
| Module | Specialized | All-in-one
vulnerability module |
9. What is policy compliance in Qualys?
It checks systems against industry standards or custom policies (like CIS, NIST) to
ensure security compliance. Reports include pass/fail status and remediation
suggestions
10. How do you deploy the Qualys agent?
Download the agent for your OS (Windows/Linux) from the Qualys portal.
Install via command-line or configuration management tools (like Ansible, SCCM).
Register the agent using a customer ID and activation ID.
Once installed, it auto-starts and reports back to the Qualys Cloud Platform.
