Qualys VMDR Integration via API

Prerequisites

• An account with Administration privileges in Qualys

• The API host URL for the platform (region) you'll be working with

Role Management (Prepare the role first)

Purpose: Assign a role that follows the principle of least privilege for the data you'll pull via API.

1. Go to Administration → Role Management in Qualys.

2. Do one of the following:

   • Recommended: Use the existing Unit Manager role (API Access must be enabled), or

   • Least privilege: Create a New Role and grant only the required permissions.

3. On the role, enable "API Access" (✔ Enabled).

4. Permissions (grant at least Read depending on the endpoints you'll call):

   • Scanner Appliances → the necessary Read/List permissions (for appliance inventory/health)

   • VM Scan Results / Host Detections → Read permission on host-based vulnerability detection data (for the actual vulnerability findings, see the second endpoint below)

5. (Optional) Narrow the Business Unit scope; allow access only to the needed asset groups/tags.

Note: The Reader role typically returns 401/unauthorized for API calls. Use Unit Manager or a custom role with API Access enabled instead.

Create a User with API Access (on Qualys VMDR)

To integrate Qualys VMDR with Logsign USO, first, create a user with API access in Qualys:

1. Log in to your Qualys instance with Admin privileges.
2. Select Administration from the dropdown menu at the top-left.

3. On the Administration page, click the Create User button.

4. Select Create Unit Manager User.
5. Configure the new user with the following settings:

• User Role: Unit Manager or higher.
• API Access: ✔ Enabled
• GUI Access: ✔ Enabled

6. Click Save.
7. The new user will receive an email to verify their login and complete the registration process. Ensure that the user activates their account.

Determine Your Qualys API Host URL

Your API endpoint URL depends on the region (platform) where your Qualys instance is hosted. Identify your platform under Help > About in your Qualys console, or from Qualys's own platform identification page.

Important: use the API host, not the console/login host. Qualys runs two separate hostnames per platform: one for the web console you log in to (the qualysguard.* address) and a separate one for the VM API this integration actually calls (the qualysapi.* address). Logsign's poller sends requests directly to whatever you enter here plus an /api/2.0/... path, so entering the console URL instead of the API URL will fail. The table below was previously showing only the qualysguard.* console addresses; use the qualysapi.* column instead.

Confirm against Help > About in your own console before relying on this table, since Qualys occasionally adds new platforms.

Data to Pull from Qualys VMDR to Logsign USO

With Logsign USO, you can retrieve the following Qualys data:

• /api/2.0/fo/appliance/ — scanner appliance inventory and health.
• /api/2.0/fo/asset/host/vm/detection/ — the actual host vulnerability detection data (per-host findings from completed scans). This is the endpoint that supplies vulnerability records; the appliance endpoint above only reports on the scanner appliances themselves.

Both endpoints are polled on every cycle.

Configure the Integration in Logsign USO

In Logsign USO, go to Settings > Data Collection > +Device, choose API as the method and Qualys VMDR as the Provider. Fill in:

Click Save. If authentication fails, re-check that the account has API Access enabled on its role (the Reader role commonly returns 401) and that the Base URL is the qualysapi.* host, not the qualysguard.* console host.