What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Qualys subscription:- Accounts - every Qualys user, with their name, email address, title, status, creation date, and last login date. Users that Qualys shows as Inactive or Pending Activation appear as disabled. Users with the Manager, Unit Manager, or Administrator user role are marked as administrators. On a subscription with Enhanced role-based access control (RBAC) turned on, Super Users are also marked as administrators. Users who hold an Administration role that can manage user accounts or roles are also marked as administrators, whatever their user role. Users who have the Security Assertion Markup Language (SAML) access permission are shown as having single sign-on configured.
- Business units - each business unit as a group, with its members. Users who aren’t in a business unit appear in the built-in Unassigned group. The business unit’s Unit Manager point of contact is shown as its manager.
- Roles - two kinds of role, with the users who hold each one:
- Qualys user roles: the one primary role each user has, such as Manager, Unit Manager, Administrator, Auditor, Scanner, Reader, Remediation User, KnowledgeBase Only, or Contact.
- Administration roles: the predefined and custom roles from the Qualys Administration module, with the permissions each role grants.
- Non-human identities - three kinds:
- API-only users: Qualys users that have API access but no graphical user interface (GUI) access.
- System users: vendor-managed Qualys users, on subscriptions with Enhanced RBAC turned on only. Oleria never deactivates, disables, or deletes them.
- Cloud Agent activation keys: each key with its status (active, disabled, or expired), expiry date, and the modules, tags, and network it binds agents to. Each key is linked to the Qualys user who owns it. Oleria never reads or stores the key value.
- Activity - events from the Qualys activity log, such as sign-ins and failed sign-ins, sign-outs, password changes and resets, user activations and deactivations, configuration changes, and downloads and uploads, with the user’s role and IP address. Other events appear with their Qualys module and action.
Oleria doesn’t import hosts, assets, asset groups, scans, reports, or vulnerabilities. This integration covers identity and access governance for your Qualys subscription only.
Prerequisites
- A Qualys subscription with API access enabled for it.
- A dedicated Qualys user for Oleria with the Manager user role and the API access permission. See Create the Qualys user.
- The Qualys platform that hosts your subscription. Find it under Help > About in the Qualys UI. Alternatively, identify it on the Qualys platform identification page. See Supported platforms.
- Optional: a second Manager user with API access, if you want Oleria to run remediation actions with a separate credential.
- Admin access to the Oleria workspace.
Why the user must be a Manager
Qualys has no read-only role that can see the whole subscription. Only a Manager sees every user together with every last login date and every activity log entry. Other roles get a narrower view, without telling Oleria that anything is missing:- A Unit Manager can manage only the users in its own business unit.
- An Administrator can’t manage Manager or Administrator users.
- Scanner and Reader users see only their own activity, without usernames.
Supported platforms
Oleria supports the 14 shared Qualys platforms. Select yours by the API server address that Help > About shows in the Qualys UI:
Oleria derives every address it calls from the platform you select. You don’t type a URL.
Create the Qualys user
1
Create the user
Sign in to the Qualys UI as a Manager. In the Vulnerability Management (VM) or Vulnerability Management, Detection and Response (VMDR) application, go to Users > Users > New > User and create a new user for Oleria. Use a dedicated user rather than a named person’s account.
2
Set the role and access
Set User Role to Manager, and give the user the API access permission. Keep GUI access for now, because you need it to activate the user.
3
Activate the user
Sign in to the Qualys UI once with the new user and accept the end user license agreement (EULA), so Qualys activates the account. Alternatively, accept the EULA for it with Qualys’s
/msp/acceptEULA.php API. Qualys refuses API requests from a user that hasn’t completed registration.4
Optional: remove GUI access
After the user is activated, you can remove its GUI access, because Oleria only uses the API. When Qualys reports the user’s GUI access as off, Oleria lists this user as an API-only user (a non-human identity), and never disables it.
5
Optional: create an action user
To run remediation actions with a separate credential, repeat these steps for a second Manager user with API access. Oleria uses this user only for actions. If you skip it, actions run as the first user.
On a subscription with Enhanced RBAC turned on, you manage users in the Qualys Administration module instead. Go to Administration > User Management > Users > Create User. The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Qualys’s own documentation.
Permissions Oleria needs
Qualys has no grantable scopes. Each read and action needs a user role plus an access permission.Read permissions
The integration’s Capabilities tab shows Read users, Read groups, and Read roles with the permissions each one needs, and checks them against the connection user.
If Qualys reports that the user or subscription isn’t authorized to use one of these APIs, Oleria marks that read as needing permission.
Write permissions
Every remediation action runs as the action user, or as the connection user when you didn’t set one. That user needs:
Before every action, Oleria reads the user list and checks that the action user is still a Manager. If not, the action doesn’t run.
Connect Qualys to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the Qualys tile.
2
Complete the connection form
3
Authenticate
Select Authenticate. Oleria signs in as the user, reads the whole user list, and checks that the user is a Manager before it saves anything. If you set an action user, Oleria checks that user the same way.
Qualys (US1).
New user address fields
Qualys requires an address, city, country, and phone number on every new user, and a state for the United States, Australia, Canada, and India. Oleria’s Create user action doesn’t carry an address, so Oleria uses the New user fields instead. Fill them in only if you want Oleria to create Qualys users. If they’re empty, the Create user action fails with a message asking for them. The other actions don’t use them.Edit the integration
When you edit the integration, select Update to save. The Qualys platform can’t be changed.- Leave Password empty to keep the stored password.
- Leave Action user password empty to keep the stored one, as long as Action username (optional) is unchanged. A new action username needs its password.
- Clear Action username (optional) to remove the stored action user. Actions then run as the connection user.
Verify the integration
Confirm Qualys appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, check that your Qualys users, business units, and roles appear in your Oleria workspace, that your Managers are marked as administrators, and that your API-only users and activation keys appear as non-human identities. If Oleria can’t connect, the message names the problem:Remediation actions
Oleria can take these actions in Qualys. Each one runs as the action user, or as the connection user when you didn’t set one.
Keep these limits in mind when you use these actions:
- Oleria reads the current state before it changes anything. A revert undoes only the change the action made. If the action changed nothing, the revert changes nothing too.
- After a role change or an activation key change, Oleria reads the state again to confirm that Qualys applied it.
- Create user can’t be reverted on a subscription without Enhanced RBAC. Qualys’s user API has no delete, and Qualys can’t deactivate a Pending Activation user. Remove or deactivate the user in the Qualys UI. If the subscription has turned on Enhanced RBAC since the user was created, reverting deletes the user.
- Create user isn’t available on Enhanced RBAC subscriptions. Create the user in Qualys.
- Delete user can’t be reverted. Recreating a user gives it a new Qualys login, so it appears in Oleria as a new account. Without Enhanced RBAC, Qualys has no delete API, so use Disable user account instead.
- Only Administration roles can be granted or revoked. Qualys doesn’t let the API change a user’s primary user role, such as Manager or Reader. On a subscription without Enhanced RBAC, Qualys doesn’t return the Administration roles of Managers, Super Users, or inactive users, so Oleria can’t confirm their current roles and refuses to change them.
- Disable NHI acts only on users that Oleria discovered as API-only users, and on activation keys.
- Qualys can’t activate or deactivate a Pending Activation user, so Oleria refuses.
- Oleria never deactivates or deletes the connection user or the action user, and never removes a role from them. It never deactivates, disables, or deletes Qualys system users.
- Oleria can’t change a user’s business unit, create business units, or reset passwords.
Enhanced RBAC
Qualys lets a Manager turn on Enhanced RBAC in the Administration module. After that, user management moves from the Vulnerability Management application to the Administration module, and Qualys’s older user APIs stop working. Oleria supports both modes. It detects which mode your subscription uses on every sync and before every action, so you don’t need to configure anything, and nothing breaks if you turn on Enhanced RBAC later. Your accounts, groups, and roles keep the same IDs in Oleria in both modes. The mode changes which actions are available:- Delete user is available only with Enhanced RBAC.
- Create user is available only without Enhanced RBAC.
Known limitations
- No multi-factor authentication status. Qualys supports two-factor authentication for sign-ins to the Qualys UI only, and no Qualys API reports it for a user or the subscription. Oleria shows MFA status as unavailable.
- No last password change date. No Qualys API reports when a user last changed their password.
- Single sign-on is shown as configured, not enforced. Oleria reads each user’s SAML access permission. Qualys doesn’t report whether single sign-on is required.
- Primary user roles and business units can’t be changed from Oleria. Qualys doesn’t allow either to be changed through its API. Change them in the Qualys UI.
- Low subscription tiers have tight API limits. Qualys limits API calls per subscription and per API. On the lowest tiers, the default is one call at a time and 50 calls a day. Oleria spaces its calls and waits when Qualys asks it to. If Qualys asks for a wait of more than a few minutes, the sync fails instead of waiting. If syncs keep failing on rate limits, ask Qualys to raise your limits.
- Private Cloud Platforms aren’t supported. Only the 14 shared platforms are.
- One subscription per integration. The platform can’t be changed after you connect. To connect another subscription or platform, add another integration.
- API-only users depend on Qualys reporting access methods. Oleria lists a user as an API-only user only when Qualys reports that the user’s GUI access is off. If Qualys doesn’t report GUI access, Oleria shows the user as a person, not a non-human identity. On Enhanced RBAC subscriptions, Qualys doesn’t report access methods, so Oleria doesn’t discover API-only users there.
- Administration roles can be partial. If your subscription doesn’t allow the Administration role APIs, Oleria shows Qualys user roles only. Without Enhanced RBAC, Qualys doesn’t list Managers, Super Users, or inactive users as holders of Administration roles.
- No creation date with Enhanced RBAC. Qualys reports a user’s creation date only on subscriptions without Enhanced RBAC.
- Activity covers the Qualys activity log only. Oleria imports at most the last 90 days. With Enhanced RBAC, the Administration audit log isn’t imported. Oleria skips its own API calls, and skips events that have no username. Configuration and user changes are linked to the Qualys subscription, not to the object they changed, because Qualys doesn’t name the object in a fixed format. On a very busy subscription, a sync window can hold more events than Oleria reads in one sync, and the rest are skipped.
- No creation date or last use for activation keys. Qualys doesn’t report them.
- Some identities aren’t inventoried. Qualys Managed Token API clients have no API to list them. Authentication records, scanner appliances, and access by Qualys partners, consultants, or Qualys Support aren’t imported.