For general information & instructions on the use of Remote Providers within ThreadFix, please refer to the Remote Providers parent page. For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API.
Introduction
Qualys Cloud Platform gives users a continuous, always-on assessment of global security and compliance posture, with 2-second visibility across all user IT assets, wherever they reside.
User Account Requirements
The Qualys account used for the ThreadFix integration must have the WAS module enabled and have “API Access” Access Permission. To retrieve vulnerability data, the user must also have at least one the following roles:
Manager
Unit Manager
Scanner
Reader
API Endpoints Used by ThreadFix
The following are the API calls ThreadFix makes to import Qualys scans:
Search scans (POST)
URL: /qps/rest/3.0/search/was/wasscan
Retrieve the results of a scan (GET)
URL: /qps/rest/3.0/download/was/wasscan/<scanid>
Search web applications (POST)
URL: /qps/rest/3,0/search/was/webapp
List Vulnerabilities (POST)
URL: /api/2.0/fo/knowledge_base/vuln