Qualys Integration with DefectDojo

Qualys Integration with DefectDojo

Qualys, Inc. provides a cloud security platform whose best-known modules are Vulnerability Management (VM, now sold as VMDR) for network and host scanning and Web Application Scanning (WAS) for dynamic testing of web apps and APIs. Findings are identified by Qualys QIDs from the Qualys KnowledgeBase and graded on a 1 to 5 severity scale. Qualys reports can be exported from the web interface or the API in XML and CSV, and DefectDojo has parsers for several of those formats plus a DefectDojo Pro connector that pulls VMDR detections directly.

Qualys Integration with DefectDojo

Qualys tells us which hosts and web applications are vulnerable. DefectDojo is where we decide who fixes what and by when. Importing Qualys results puts each QID on the Asset that owns the host or application, with its CVEs, CVSS data, Qualys solution text, and an endpoint for every affected system. Infrastructure and web app findings end up next to SAST, SCA, and pentest results for the same Asset, under one set of SLAs, and reimporting the next scan closes what was patched.

Why Qualys Matters

Network and host scanning remains the main way most organizations learn about missing patches and exposed services, and Qualys is widely deployed for it.

• The KnowledgeBase gives every check a stable QID with threat, impact, and solution text, which keeps findings consistent from scan to scan.
• Qualys separates confirmed vulnerabilities from potential ones and from information gathered, which helps teams decide what needs action.
• WAS covers the web tier with crawling, authenticated scanning, and request and response evidence.
• Qualys tracks detections per host. It is not where application owners see infrastructure findings alongside their code and dependency findings.

Advantages of This Integration

What we gained by routing Qualys results through DefectDojo:

• Host-aware deduplication. Qualys Scan findings are hashed on title, severity, and endpoints, so the same QID on the same host is recognized across scans.
• Status from Qualys. For Qualys Scan XML, the Qualys vulnerability status drives the finding: Active, New, and Re-Opened detections import as active, and others arrive mitigated with the Qualys last-fixed date.
• Lifecycle on reimport. Reimporting into the same Test mitigates detections that are gone, adds new ones, and reactivates regressions.
• CVE search. CVEs from the KnowledgeBase entry are stored as vulnerability IDs on Qualys Scan findings, so one search shows every host affected by a given CVE.
• Scheduled sync with DefectDojo Pro. The Qualys connector pulls VMDR detections over the Qualys API, so no one has to export reports.
• SLAs and ownership. Every finding carries a DefectDojo severity, can be assigned, risk-accepted, or pushed to Jira.

How This Integration Works

DefectDojo supports several Qualys scan types (a separate Qualys VMDR CSV parser also exists). This page covers:

• Qualys Scan for host vulnerability reports in Qualys XML (from the API or the web interface) or CSV. For CSV, set CVSS Version = CVSSv3 in the Scan Report Template and include Threat, Impact, Patches and Workarounds, Virtual Patches and Mitigating Controls, and Results.
• Qualys Infrastructure Scan (WebGUI XML) for scan result XML exported from the Qualys web interface.
• Qualys Webapp Scan for Qualys WAS XML reports (scan reports or web application reports).
• Qualys Hacker Guardian Scan for CSV exports from HackerGuardian PCI scanning, which uses Qualys QIDs and severity levels.

Option 1: File import (Community Edition and DefectDojo Pro). In the UI, open the Engagement, choose Import Scan Results, select the matching Qualys scan type, and upload the file. For automation, use the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Qualys Scan" \
  -F "file=@qualys-host-report.xml" \
  -F "product_name=datacenter-east" \
  -F "engagement_name=Monthly VM Scan" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer, here for a WAS report:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Qualys Webapp Scan" \
  --report-path "./qualys-was-report.xml" \
  --product-name "customer-portal" \
  --engagement-name "Weekly WAS" \
  --auto-create-context

Option 2: Qualys connector (DefectDojo Pro). The connector imports VMDR host detections, each joined with its KnowledgeBase metadata, and creates a Record for each Qualys host. Configure it with:

1. Your Qualys API server URL in Location (it differs per platform, for example https://qualysapi.qualys.com).
2. A Qualys user with VMDR API access in Username, and its password in Secret.
3. Optionally, Host Tags to limit discovery to hosts carrying specific Qualys asset tags. Names match exactly and wildcards are not supported.
4. Optionally, Create endpoints from hosts to attach each finding to its host (DNS, NetBIOS, or IP, plus port) as an endpoint.
5. Optionally, a Minimum Severity.

Detections Qualys marks Fixed are excluded, so each sync closes remediated findings.

Data Granularity: What Gets Imported

The table describes the Qualys Scan XML import, the most common file path.

How the other scan types differ:

Use Cases

For monthly patch cycles: Infrastructure teams import the Qualys host report after each scan window and reimport into the same Test. Patched QIDs close automatically, and the remaining findings show their age against the SLA.

For application owners: A team that owns a set of servers sees the Qualys findings for those hosts on its own Asset, next to its SAST and dependency findings, instead of asking the scanning team for a filtered report.

For web applications: Qualys WAS reports import as one finding per QID with every affected URL attached, which keeps DAST results manageable on large sites.

For PCI scope: Merchants that run HackerGuardian quarterly scans import the CSV into a PCI Engagement to track remediation of external findings between scans.

Operational Tips

• Know which severity mapping you run. DD_QUALYS_LEGACY_SEVERITY_PARSING defaults to true, mapping Qualys 1 to 5 onto Info through Critical. Setting it to false maps 1 and 2 to Low, 3 to Medium, and 4 and 5 to High for Qualys Scan imports.
• Qualys Webapp Scan treats information gathered items as Info. Setting DD_QUALYS_WAS_WEAKNESS_IS_VULN to true applies the Qualys severity to security weaknesses instead, while scan diagnostics stay Info.
• Use one scan type per Test and stick with it. The four Qualys scan types use different titles and deduplication, so switching formats midstream creates new findings.
• On DefectDojo Pro, scope the connector with Host Tags before the first sync. Discovering every host in a large subscription makes each sync slower and the Record list longer.
• Use minimum_severity to keep information gathered QIDs out of SLA reporting if your team does not act on them.
• Tag imports with the scan window or environment (for example tags=2026-10,prod) for trend reporting.