Qualys Vulnerability Management Integration - SaaS

When running JavaScript data feeds, you can set the system to only allow digitally signed JavaScript files from trusted sources for security considerations.

For a certificate to be trusted, all certificates in the chain, including the Root CA Certificate and Intermediate CA certificates, must be trusted on both the Web Server and Services Server machines.

By default, the Archer Technology LLC certificate is not present on every machine’s root.

1. On the JavaScript file, right-click and select Properties.

   1. Click the Digital Signatures tab.

   2. From the Signature List window, select Archer Technologies LLC.

   3. Click the Details button.

   4. Click View Certificate.

   5. Click Install Certificate.

   6. Select Local Machine.

   7. Click Next.

   8. Select Place all certificates in the following store, and click Browse.

      1. Select Trusted Root Certification Authorities, and click OK.

      2. Click Next.

      3. Click Finish.

2. Click OK.

1. On the Web Server and Services Server machines, open the Manage User Certificates program.

   1. From the Windows Start menu, launch certmgr. (Manage User Certificates).

   2. Navigate to Certificates – Local Computer > Trusted Root Certification Authorities > Certificates.

   3. Ensure the following certificates are in the Certificates sub-folder of the Trust Root Certification Authorities folder:

      • Archer Technologies LLC.

      • Archer Security 2048 V3 (Standard certificate).

2. Verify that the certificate is trusted.

   1. Double-click the Archer Technologies LLC certificate.

   2. In the Certificate window, click the Certification Path tab.

   3. Ensure that the Certificate Status window displays the following message: “This certificate is OK.”

      Note: If the Certificate Status window displays a different message, follow the onscreen instructions.

3. Obtain the trusted certificate thumbprint.

   1. In the Certificate window, click the Details tab.

   2. Scroll to and select the Thumbprint field.

      The certificate's digital thumbprint appears in the window.

   3. Copy the thumbprint.

      Note: For information on adding digital thumbprints, see Step 7a of "Configuring the JavaScript Transporter Settings".

The following data feeds are provided with this integration.

• Archer Qualys VM Knowledge Base. Utilizes API calls to extract all exploitable vulnerabilities from a Qualys vulnerability database. Qualys data is imported and leveraged in the Vulnerability Library application. 

• Archer Qualys VM Hosts. Utilizes API calls to extract all the asset inventory discovered based on a client’s scanner configuration and implementation.  Qualys VM data is imported and leveraged in the Devices application. For data ingestion, Archer offers configurable settings that allow individual clients to define how to uniquely identify devices in their organization.

• Archer Qualys VM Hosts Extracted From Detections. Utilizes API calls to extract all the asset inventory from the hosts vulnerability detection data.  Qualys VM data is imported and leveraged in the Devices application. For data ingestion, Archer offers configurable settings that allow individual clients to define how to uniquely identify devices in their organization.

• Archer Qualys VM Hosts Extracted From Detections - Fixed Detections Only. Works the same as the Qualys VM Hosts Extracted From Detections feed, but it only queries hosts that have a fixed vulnerability for the time frame requested.

• Archer Qualys VM Detections. Utilizes API calls to extract a list of hosts with the hosts latest vulnerability data. For data ingestion, Archer offers configurable settings that allow individual clients to define how to uniquely identify vulnerability detections in their organization.

• Archer Qualys VM Detections - Fixed Detections Only. works the same as the Qualys VM Detections feed, but it only pulls detections in the "fixed" status. This is useful to optimize data feed performance.

Important: You must install all package files before importing data feeds. Package files include the IT Security Vulnerabilities Program use case package, the Enterprise Catalog package, and the Issues Management prerequisite use case package. For more information, see the “Installing the Packages” section of the IT Security Vulnerabilities Program use case in the Archer Online Documentation.

Import and run the data feeds in the following order:

1. (Optional) Import and run the NVD Data Feeds. For information on setting up the NVD data feeds, see the NIST National Vulnerability Database (NVD) Integration.

2. Set up these data feeds to run as convoy. Schedule the Knowledge base feed and have each run after the last. It is important to run the KB, Hosts, and Detections in that order.

   1. Archer Qualys VM Knowledge Base.dfx5

   2. Archer Qualys VM Hosts.dfx5

   3. Archer Qualys VM Hosts Extracted From Detections.dfx5 (optional for certain fields OS information only)

   4. Archer Qualys VM Hosts Extracted From Detections - Fixed Detections Only.dfx5 (optional for certain fields OS information only)

   5. Archer Qualys VM Detections.dfx5

   6. Archer Qualys VM Detections - Fixed Detections Only.dfx5 (can be on a different schedule)

Note: After setting up the data feeds, you can schedule the feeds to run when you want to. The Archer Qualys VM feeds are designed in a way they can easily be decoupled and initiated on a more frequent schedule basis to fit your needs. For more information, see the Scheduling Data Feeds section.

The integration leverages the API (/api/2.0/fo/knowledge_base/vuln/?action=list) to obtain vulnerability data, such as the vulnerability description, threat, and impact. The feed initiates the request to download the vulnerabilities from Qualys’ Knowledge Base by targeting the Qualys platform where your account is located, along with the availability to pass additional API parameters.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

Important: Due to high volume of Knowledge Base content, the data feed will retrieve the content for the last 10 years only. For the initial base load of data, the data feed should be executed with the last_modified_after parameter set to <LastRunTime> (default setting) and the Last Run Time at the Run Configuration setting should be blank. On subsequent data feed executions since the Last Run Time token will be populated by after the initial data feed execution, the data feed will update incremental content.

Data feed execution parameter values

Due to inconsistent high volume of data, the data feed should be executed with the following parameter values. 

• requestsPerMin = 5 for Qualys Standard Level Subscription(default), 12 for Enterprise Level Subscription and 33 for premium level subscription.

• last_modified_after = The default value is <LastRunTime> token. The first run of the data feed will be for initial data population as the token is empty. For subsequent runs, the data feed will take the Last Run Token value and update the incremental data. In case of specific requirements, provide the value of the required date in YYYY-MM-DD format.

• last_modified_before= The default value of the parameter is Current Date. In case of specific requirements, provide the value of the required date in YYYY-MM-DD format.

• daysToBeIncremented= The default value has been set to 45 days. The maximum value that can be set is 50 days.

• The Max Memory Limit (MB) in the JavaScript Transporter settings of Archer Control Panel was increased to 2048 MB (default 1024 MB).

The data feed executed successfully during the testing with the above set of parameters. In case the script fails due to high volume of data, apply the following configurations and execute the data feed again.

• Decrease the `daysToBeIncremented` parameter values.

• Increase the Max Memory Limit (MB) in the JavaScript Transporter settings of Archer Control Panel

Important: No truncation_limit is available for Knowledge Base data. Ultimately without the availability of a truncation_limit, we are unable to fully leverage our output writer and therefore not able to write portions of the data to file. We are storing the entirety of the data in memory which requires a temporary increase in the Max Memory Limit in the Archer Control Panel. The data feed will pull data for the last 10 years only. This limit has been set due to high volume of data.

To facilitate a successful initial load of the knowledge base, use the 'last_modified_after' and 'last_modified_before' parameters to limit the data loaded. Load the knowledge base from oldest to newest.

1. last_modified_after = 2000-01-01 and last_modified_before = 2010-12-31

2. last_modified_after = 2010-01-01 and last_modified_before = 2020-12-31

3. last_modified_after = 2020-01-01 and last_modified_before = 2024-12-31

The nearer the current date, the larger the volume of data being modified. Adjust accordingly until current date is reached. Then run the data feed using the LastRunTime token value and run the data feed as the start of the series of feeds.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Knowledge Base.dfx5 file.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the signed-QualysAPI_1.1.js file and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.

    Key	Value	Description
    dataSource	kb	Must be 'kb' to pull knowledge base
    kbUrl	https://<Insert platform API Server> /api/2.0/fo/knowledge_base/vuln/ ?action=list&details=All &last_modified_after=<LastRunTime>	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide (https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf). For initial data loads, Archer recommends using parameters that chunk the data into consumable sizes to avoid memory constraint failures. LastRunTime is a token captured in by Archer in the data feed execution.  Logic: Use LastRunTime token if valid date supplied, and if requested in the kbURL. If the LastRunTime token is not supplied but requested in the kbURL, default LastRunTime = 1970-01-10. A lastRunTimeOffset of -1 is added to the LastRunTime date in the form of days.
    username	Requires valid value. Default = [empty]	Qualys user name
    password	Requires valid value. Default = [empty]	Qualys password
    requestsPerMin	Requires valid value. Default=60	Please follow the Qualys API Limits document for determining the API limits for your Qualys Service. https://cdn2.qualys.com/docs/qualys-api-limits.pdf Standard API Service: 300 calls per hours/ 5 calls per minute Enterprise API Service: 750 calls per Hour/12 calls per minute Premium API Service: 2000 calls per Hour/ 33 calls per minute Note: The API limit of the data feed by default has been set to 5. Please check your Qualys Service Level before setting the value. This field should not be left blank.
    last_modified_after	Optional Default= Current Date-10 years Format= YYYY-MM-DD	This parameter has been set to <LastRunTime> by default. For the first run of the data feed, as the LastRunTime token is empty this parameter will be set to Current Day-10 years. For the subsequent data feed runs, the field will take the <LastRunTime> token and update the incremental data.
    last_modified_before	Optional Default = Current Date  Format=YYYY-MM-DD	The parameter if blank will be set to current date.
    daysToBeIncremented	Requires valid value. Default =50	The default value for the Data Feed has been set to 45 days. Due to the high volume of data, the parameter if required can be decreased.
    lastRunTimeOffset	-1

    Important: The keys and values are case-sensitive and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file.

    Key	Value	Description
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the number of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, like browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab. Click the Tokens sub-tab, and verify token values.

14. The following table describes token values to verify.

    Token	Value
    LastRunTime	(Populated by feed)

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Platform Help.

15. Verify that key field values are not missing from the data feed setup window.

16. Click Save.

The integration leverages the API (/api/2.0/fo/asset/host/?action=list) to obtain a list of scanned hosts in the user’s account. The feed initiates the request to download the hosts by targeting the Qualys platform where your account is located, along with the availability to pass additional API parameters.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

Important: Archer implements with a unique key on DNS identification. However, we understand that environment configurations are unique across an organization’s infrastructure, therefore the unique key to identify if a Device already exists inside Archer, is configurable to each client. And where clients have multiple scanners scanning the same set of devices or IP ranges, the unique key should be altered to a matching algorithm that identifies the device, regardless of the source.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Hosts.dfx5 file for the data feed.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the Signed-QualysAPI_1.1.js file, and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.    

    Key	Value	Description
    dataSource	hosts	Must be "hosts".
    hostsUrl	{URL}/api/2.0/fo/asset/host/?action=list&details=All&show_tags=1&show_trurisk=1	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf.
    username	Requires valid value Default = [empty]	Qualys username
    password	Requires valid value Default = [empty]	Qualys password

    Important: The keys and values are case-sensitive, and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. (Optional) The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file.

    Key	Value	Description
    batchSize	Default = 500 (records at a time) [Configurable]	Truncation_limit is a supported parameter to specify a maximum number of hosts records to process in a single call. JavaScript makes incremental calls to pull the next batch of data. If the requested list identifies more host records than the truncation limit, then the XML output includes the element and the URL for making another request for the next batch of host records.
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the amount of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, similar to browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab.

    1. Click the Tokens sub-tab.

    2. Verify token values.

    The following table describes token values to verify.

14. Token	Value
    LastRunTime	(Populated by feed)

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Online Documentation.

15. Verify that key field values are not missing from the data feed setup window.

16. Click Save.

This integration is optional, to extract certain OS fields.

The integration leverages the API (/api/2.0/fo/asset/host/vm/detection/) to obtain a list of hosts with the hosts latest vulnerability data, based on the host based scan data available in the user’s account. From this data, we specifically capture additional information regarding hosts identified as part of the vulnerability data extraction. The feed initiates the request to download the host detection data by targeting the Qualys platform where your account is located, along with the availability to pass additional API parameters.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

Important: Archer implements with a unique key on DNS identification. However, we understand that environment configurations are unique across an organization’s infrastructure, therefore the unique key to identify if a Device already exists inside Archer, is configurable to each client. And where clients have multiple scanners scanning the same set of devices or IP ranges, the unique key should be altered to a matching algorithm that identifies the device, regardless of the source.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Hosts Extracted From Detections.dfx5 file for the data feed.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the Signed-QualysAPI_1.1.js file and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.

    Key	Value	Description
    dataSource	hostDetections	Must be "hostDetections".
    detectionUrl	{URL}/api/2.0/fo/asset/host/vm/detection/?action=list&detection_updated_since=<LastRunTime>&show_tags=1	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf). If the status parameter is not passed to the API, by default, the output only contains detections with New, Active, or Re-Opened.   LastRunTime is a token captured in by Archer in the data feed execution.  Logic: Use LastRunTime token if valid date supplied, and if requested in the detectionURL. If the LastRunTime token is not supplied but requested in the detectionURL, default LastRunTime = 1970-01-10, in specified batches. A lastRunTimeOffset of -1 is added to the LastRunTime date in the form of days.
    username	Requires valid value Default = [empty]	Qualys username
    password	Requires valid value Default = [empty]	Qualys password

    Important: The keys and values are case-sensitive, and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. (Optional) The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file. 

    Key	Value	Description
    batchSize	Default = 500 (records at a time) [Configurable]	Truncation_limit is a supported parameter to specify a maximum number of hosts records to process in a single call. JavaScript makes incremental calls to pull the next batch of data. If the requested list identifies more host records than the truncation limit, then the XML output includes the element and the URL for making another request for the next batch of host records.
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the number of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, similar to browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab.

    1. Click the Tokens sub-tab.

    2. Verify token values.

    The following table describes token values to verify.

    Token	Value
    LastRunTime	(Populated by feed)

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Platform Help.

14. Verify that key field values are not missing from the data feed setup window.

15. Click Save.

This data feed is optional.

This feed works the same as the Qualys VM Hosts Extracted From Detections feed, but it only queries hosts that have a fixed vulnerability for the time frame requested.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

Important: Archer implements with a unique key on DNS identification. However, we understand that environment configurations are unique across an organization’s infrastructure, therefore the unique key to identify if a Device already exists inside Archer, is configurable to each client. And where clients have multiple scanners scanning the same set of devices or IP ranges, the unique key should be altered to a matching algorithm that identifies the device, regardless of the source.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Hosts Extracted From Detections.dfx5 file for the data feed.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the Signed-QualysAPI_1.1.js file and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.

    Key	Value	Description
    dataSource	hostDetections
    detectionUrl	{URL}/api/2.0/fo/asset/host/vm/detection/?action=list&detection_updated_since=<LastRunTime>&show_tags=1	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf). If the status parameter is not passed to the API, by default, the output only contains detections with New, Active, or Re-Opened.   LastRunTime is a token captured in by Archer in the data feed execution.  Logic: Use LastRunTime token if valid date supplied, and if requested in the detectionURL. If the LastRunTime token is not supplied but requested in the detectionURL, default LastRunTime = 1970-01-10, in specified batches. A lastRunTimeOffset of -1 is added to the LastRunTime date in the form of days.
    username	Requires valid value Default = [empty]
    password	Requires valid value Default = [empty]

    Important: The keys and values are case-sensitive, and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. (Optional) The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file. 

    Key	Value	Description
    batchSize	Default = 500 (records at a time) [Configurable]	Truncation_limit is a supported parameter to specify a maximum number of hosts records to process in a single call. JavaScript makes incremental calls to pull the next batch of data. If the requested list identifies more host records than the truncation limit, then the XML output includes the element and the URL for making another request for the next batch of host records.
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the number of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, similar to browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab.

    1. Click the Tokens sub-tab.

    2. Verify token values.

    The following table describes token values to verify.

    Token	Value
    LastRunTime	(Populated by feed)

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Help.

14. Verify that key field values are not missing from the data feed setup window.

15. Click Save.

The integration leverages the API (/api/2.0/fo/asset/host/vm/detection/) which provides a list of hosts with each hosts latest vulnerability data, based on the host-based scan data available in the user’s account. Vulnerability detection data includes the latest complete vulnerability status for the hosts (New, Active, Re-Opened) and the history information. The feed initiates the request to download the host detection data by targeting the Qualys platform where your account is located, along with the availability to pass additional API parameters.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

For detections, Archer implements with a unique key concept to associate the detection to a host and a vulnerability definition. However, environment configurations are unique across an organization’s infrastructure, therefore the unique keys are configurable to each client, such as determining if a device already exists in your Archer environment. Where clients have multiple scanners scanning the same set of devices or IP ranges, the unique key should be altered to a matching algorithm that identifies the device, regardless of the source.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Detections.dfx5 file for the data feed.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the Signed-QualysAPI_1.1.js file and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.

    Key	Value	Description
    dataSource	detections	Must be "detections".
    detectionUrl	{URL}/api/2.0/fo/assset/host/vm/detection/?list&detection_updated_since=<LastRunTime>&show_tags=1	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf). If the status parameter is not passed to the API, by default, the output only contains detections with New, Active, or Re-Opened. LastRunTime is a token captured in by Archer in the data feed execution.  Logic: Use LastRunTime token if valid date supplied, and if requested in the detectionURL. If the LastRunTime token is not supplied but requested in the detectionURL, default LastRunTime = 1970-01-10, in specified batches. A lastRunTimeOffset of -1 is added to the LastRunTime date in the form of days.
    username	Requires valid value Default = [empty]	Qualys username
    password	Requires valid value Default = [empty]	Qualys password

    Important: The keys and values are case-sensitive and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. (Optional) The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file. 

    Key	Value	Description
    batchSize	Default = 500 (records at a time) [Configurable]	Truncation_limit is a supported parameter to specify a maximum number of hosts records to process in a single call. JavaScript makes incremental calls to pull the next batch of data. If the requested list identifies more host records than the truncation limit, then the XML output includes the element and the URL for making another request for the next batch of host records.
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the amount of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, similar to browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab.

    1. Click the Tokens sub-tab.

    2. Verify token values.

    The following table describes token values to verify.

    Token	Value
    LastRunTime	(Populated by feed)
    CrossReferencesMode	LinkOnly
    RelatedReferencesMode	LinkOnly

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Help.

14. Verify that key field values are not missing from the data feed setup window.

15. Click Save.

The integration leverages the API (/api/2.0/fo/asset/host/vm/detection/) which provides a list of hosts with each hosts latest vulnerability data, based on the host-based scan data available in the user’s account. Vulnerability detection data includes the latest complete vulnerability status for the hosts (Fixed) and the history information. The feed initiates the request to download the host detection data by targeting the Qualys platform where your account is located, along with the availability to pass additional API parameters.

Important: Before you upload a JavaScript file, configure JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

Important: Except for the parameters specified in this procedure, changes to the JavaScript file can only be achieved with a Professional Services engagement. For more information, contact your account representative.

For detections, Archer implements with a unique key concept to associate the detection to a host and a vulnerability definition. However, environment configurations are unique across an organization’s infrastructure, therefore the unique keys are configurable to each client, such as determining if a device already exists in your Archer environment. Where clients have multiple scanners scanning the same set of devices or IP ranges, the unique key should be altered to a matching algorithm that identifies the device, regardless of the source.

1. Go to the Manage Data Feeds page with the following steps:

   1. From the menu bar, click the icon.

   2. Under Integration, click Data Feeds.

2. In the Manage Data Feeds section, click Import.

3. Locate and select the Archer Qualys VM Detections.dfx5 file for the data feed.

4. Click Open.

5. In the General Information section, in the Status field, select Active.

6. In the Additional Properties section, enable Optimize Calculations.

7. Click the Transport tab.

8. In the Transport Configuration section, complete the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the Signed-QualysAPI_1.1.js file and click Open.

   4. From the Upload JavaScript File dialog, click OK.

9. In the Custom Parameters section, enter key values.

10. The following table describes the value to enter for each key in Custom Parameters.

    Key	Value	Description
    dataSource	detections	Must be "detections".
    detectionUrl	{URL}/api/2.0/fo/assset/host/vm/detection/?action=list&status=Fixed&detection_updated_since=<LastRunTime>&show_tags=1	Note: For a complete list of supported parameters for this URL call and their explanations, see the Qualys API 2.0 Reference Guide https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf). If the status parameter is not passed to the API, by default, the output only contains detections with New, Active, or Re-Opened. LastRunTime is a token captured in by Archer in the data feed execution.  Logic: Use LastRunTime token if valid date supplied, and if requested in the detectionURL. If the LastRunTime token is not supplied but requested in the detectionURL, default LastRunTime = 1970-01-10, in specified batches. A lastRunTimeOffset of -1 is added to the LastRunTime date in the form of days.
    username	Requires valid value Default = [empty]	Qualys username
    password	Requires valid value Default = [empty]	Qualys password

    Important: The keys and values are case-sensitive and cannot include extra spaces at the end of the strings.

    Note: The listed values are in place by default. They can be configured to suit your environment.

11. (Optional) The following additional parameters are valid options for the Custom Parameters section for the current JavaScript file. 

    Key	Value	Description
    batchSize	Default = 500 (records at a time) [Configurable]	Truncation_limit is a supported parameter to specify a maximum number of hosts records to process in a single call. JavaScript makes incremental calls to pull the next batch of data. If the requested list identifies more host records than the truncation limit, then the XML output includes the element and the URL for making another request for the next batch of host records.
    requestsPerMin	Default = 60 [Configurable value]	A parameter to allow clients to govern the number of API requests made by Archer to the external integration. Qualys Cloud Platform enforces limits on the API calls subscription users can make. The limits apply to the use of all APIs, except “session” API (session login/logout).
    socketLimit	Default = 10 [Configurable value of 1-25]	Indicates the maximum number of open socket channels to an endpoint to be used for TCP connections.
    maxRetry	Default = 1 [Configurable value of 0-2]	Indicates the amount of times a retry will occur where an "ECONNRESET" error is encountered. If a retry is unsuccessful and the maxRetry is exceeded, the data feed will fail.
    proxy	Optional Default = [empty]
    verifyCerts	Default = False  [Configurable value of True / False]	Validates the website address matches the address on the certificate, similar to browser level validation.

12. For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

13. Click the Source Definition tab.

    1. Click the Tokens sub-tab.

    2. Verify token values.

    The following table describes token values to verify.

    Token	Value
    LastRunTime	(Populated by feed)
    CrossReferencesMode	LinkOnly
    RelatedReferencesMode	LinkOnly

    Note: For more information about tokens, see "Data Feed Tokens" in the Archer Help.

14. Verify that key field values are not missing from the data feed setup window.

15. Click Save.