The Qualys Cloud Platform and its integrated apps can simplify security operations and lower the cost of compliance by delivering critical security intelligence on demand and automating the full spectrum of auditing, compliance and protection for IT systems and web applications. Qualys Scanner Appliance is an option with the Qualys Cloud Platform. With the Qualys Scanner Appliance, you can easily assess internal network devices, systems and web applications.  This post summarize some of my experience with Qualys Guard service from Qualys Scanner Appliance.

1. Assetview Tag 

Asset Search – Dynamic Rule
Search all assets found / scanned in last 90 days:

Qualys_Asset_View_2.png?resize=800%2C546&ssl=1Qualys_Asset_View_2.png?resize=800%2C546&ssl=1 Qualys_Asset_View.png?resize=800%2C615&ssl=1Qualys_Asset_View.png?resize=800%2C615&ssl=1

<?xml version=”1.0″ encoding=”UTF-8″?><TAG_CRITERIA> <LAST_SCAN_DATE>  <SEARCH_TYPE>WITHIN</SEARCH_TYPE>  <DAYS>270</DAYS> </LAST_SCAN_DATE></TAG_CRITERIA>

2. Enable Agentless Tracking

To reduce / suppress the duplicated assets because of dhcp, one of effective methods is to enable agentless tracking.

Agentless Tracking

In order to support Agentless Tracking capabilities, QualysGuard will write a unique host ID on your Windows and/or Unix hosts during authenticated scans with agentless tracking enabled. Once the Manager primary contact has accepted this feature, agentless tracking may be enabled in Windows and/or Unix authentication records. For additional help, please visit the  online help .

2.1. VM > Scans > Setup > Agentless Tracking > Accept

Agentless_tracking_1.png?resize=800%2C514&ssl=1Agentless_tracking_1.png?resize=800%2C514&ssl=1

2.2. VM > Scans > Authentication > Edit [Your Authentication Record] > Login Credentials > “Enable Agentless Tracking”

Agentless_tracking_2.png?resize=800%2C569&ssl=1Agentless_tracking_2.png?resize=800%2C569&ssl=1

2.3. VM > Users > Setup > Cloud Agent Setup > “Show unified view of hosts”

Agentless_tracking_3.png?resize=800%2C355&ssl=1Agentless_tracking_3.png?resize=800%2C355&ssl=1

Note: QID 45179 for successfully checked tracking
QID 45180 – for failed

3. Change IP tracked host assets to DNS 

Qualys provides multiple mechanisms for tracking assets in your environment; IP, DNS, NetBIOS, Agent, and EC2. In Qualys IP tracking is the default mechanism. DNS and NetBIOS tracking are most useful for DHCP networks.

DNS_hostname_tracking_method.png?resize=800%2C552&ssl=1DNS_hostname_tracking_method.png?resize=800%2C552&ssl=1

Note:

To change all ip tracking method machines to dns hostname tracking, I will need to search all assets with DNS name is not empty and tracking method is IP, then put them into a new group to do whatever you need to do, or edit all of them to change tracking method.
Search-and-Change-Tracking-Method-1-Asset-Search.png?resize=800%2C612&ssl=1Search-and-Change-Tracking-Method-1-Asset-Search.png?resize=800%2C612&ssl=1 Search-and-Change-Tracking-Method-2-Asset-Search.png?resize=800%2C647&ssl=1Search-and-Change-Tracking-Method-2-Asset-Search.png?resize=800%2C647&ssl=1
Search-and-Change-Tracking-Method-3-Asset-Search.png?resize=800%2C631&ssl=1Search-and-Change-Tracking-Method-3-Asset-Search.png?resize=800%2C631&ssl=1 Search-and-Change-Tracking-Method-4-Asset-Search.png?resize=800%2C724&ssl=1Search-and-Change-Tracking-Method-4-Asset-Search.png?resize=800%2C724&ssl=1

4. Purge Assets Older than 90 Days

The idea is to find all assets not scanned in last 90 days then purge them all.

Asset_Search_and_Purge_2-_Asset_Search.png?resize=800%2C629&ssl=1Asset_Search_and_Purge_2-_Asset_Search.png?resize=800%2C629&ssl=1 Asset_Search_and_Purge_1-_Asset_Search.png?resize=800%2C545&ssl=1Asset_Search_and_Purge_1-_Asset_Search.png?resize=800%2C545&ssl=1

Best Practice to maintain a timely and effective report in Qualys from Qualys Community:

1) Purge any assets that have not been scanned in some reasonable number of days.  Depending on your scanning schedule this might be 30, 60, or 90 days.
2) Determine if this is DHCP and set the tracking method for the network range appropriately.  NOTE: To convert to DNS or NetBIOS tracking all assets must have a DNS or NetBIOS name on them already.  So, there may be some clear up and rescanning required to make that happen.
3) Configure and test authentication records, ensure Agentless Tracking enabled in the authentication record.
4) Review your scheduled scan jobs and make any adjustments necessary in option profiles, authentication records etc
5) Scan your ranges
6) It is always a good practice to have a regular purge process.  This can be accomplished in numerous ways, but for good VM practice, it is imperative that the vulnerability data be accurate, timely, and actionable.  

Youtube Video: