Skip to main content

​
About Qualys

The Qualys integration lets Serval workflows work with your Qualys Vulnerability Management subscription through the VM/PC v2 API: per-host vulnerability detections, the vulnerability KnowledgeBase, VM scans, scan schedules, reports, asset groups, and asset IPs. Qualys’s XML responses are converted to JSON automatically. Authentication: A Qualys username and password. Serval stores the credentials securely and sends them (HTTP Basic) only to the API server of the platform you select. Access level: You choose what Serval may do when you connect — and Serval enforces it server-side on every request:
  • Read-only — list and fetch data only.
  • Scanner — read, plus launch and manage scans and reports.
  • Full — read, scan, and manage assets (asset groups and asset IPs).
Data sync: On demand. Serval reads data from Qualys when a workflow runs and does not perform a background sync.

​
Create a Qualys API user

1

Check API access

Your Qualys subscription must include API access (most VMDR subscriptions do). Contact your Technical Account Manager if API calls return an access error.
2

Create a dedicated user

In Qualys, open Users, then create a user dedicated to Serval. A Reader role is sufficient for the Read-only access level; use a Scanner role if Serval should launch scans, or Manager for full asset management.
3

Confirm the platform

Note your platform (shown under Help > About in the Qualys UI, e.g. US Platform 2) — you will select it in Serval.

​
Connect in Serval

1

Name the connection

Enter a recognizable instance name, such as Production.
2

Select the platform

Choose the Qualys platform where your subscription is hosted. Serval only sends credentials to that platform’s published API server.
3

Enter the credentials

Enter the API user’s username and password.
4

Choose the access level

Select Read-only, Scanner, or Full. Serval blocks any request beyond the selected level before credentials are attached, regardless of the Qualys user’s own permissions.

​
Verify the connection

Serval checks that it can list host assets, VM scans, and reports, and read the vulnerability KnowledgeBase. A failed check normally means the credentials are invalid, the wrong platform was selected, or the Qualys user lacks the corresponding permission or module.
Qualys enforces per-subscription API rate and concurrency limits and returns Retry-After headers when they are exceeded; Serval honors these automatically. Large detection queries should use the truncation_limit parameter — Serval follows the pagination URL Qualys returns.
Need help? Contact support@serval.com for assistance with your Qualys integration.