Qualys Vulnerability Management
Configure Qualys VMDR integration with RAD Security for comprehensive vulnerability management.
A direct Qualys VMDR connector is available in early access. It keeps Qualys' own vocabulary — severity 1–5, status New/Active/Fixed/Re-Opened — and adds closure tracking with time-to-remediate. See the field reference for what it stores. The integration on this page remains supported.
This guide walks you through integrating Qualys Vulnerability Management (VMDR) with RAD Security, enabling you to import vulnerability findings and correlate them with runtime security events.
Qualys VMDR provides comprehensive vulnerability scanning, asset discovery, and compliance reporting for your infrastructure.
Prerequisites
Before you begin, ensure you have:
- Admin access to Qualys Vulnerability Management
- Manager or Unit Manager role in Qualys
- A service email account that will remain active (not tied to an individual employee)
- Access to RAD Security workspace with integration permissions
Service Account Best Practice: Use a service email account (e.g., security-services@company.com) rather than an individual's email. This ensures the integration continues working even if employees leave the organization.
Step 1: Create Service User in Qualys
Log in to Qualys as Administrator
Log in to Qualys with an account that has either the Manager or Unit Manager role
Navigate to Users Management
- Navigate to the Vulnerability Management product
- Click the USERS option from the top menu (located toward the right side)
Create New User
- In the Users interface, click New > User
- This will open a modal titled New User
Enter User Details
Under the General Information section, provide:
- First Name (e.g., "RAD Security")
- Last Name (e.g., "Integration")
- Title (e.g., "Service Account")
- Phone
- Email Address (use your service email account)
- Address 1
- Country
Configure User Role
In the User Role section:
- Select the Reader role
- Reader: Read-only vulnerability data access — this is all the RAD Security integration requires
- Check both the GUI and API boxes
For RAD Security integration, the Reader role with API access is sufficient. RAD only reads vulnerability findings and never launches scans or writes back to Qualys, so no scan-capable role (such as Scanner) is required.
Assign Asset Groups
Under Asset Groups on the left:
- Click the Add asset groups dropdown
- Select either:
- All - Grant access to all assets (recommended for complete visibility)
- Specific asset groups - Choose individual groups if you want to limit scope
Save and Note Username
- Click the Save button at the far right corner of the modal
- After creation, locate the new user entry in the users list
- Note the randomly generated username for this account - you'll need this later
Log Out
Log out of your administrator account
Save the username immediately! The randomly generated username is only displayed in the users list and will be needed for authentication.
Step 2: Complete Service Account Registration
Check Registration Email
The service email address will receive a registration message from Qualys containing:
- A link to begin the user registration process
- An OTP (One-Time Password) code
Copy the OTP code - you'll need it on the next screen
Complete Registration
- Click the link in the email to begin registration
- Follow the prompts to complete the registration process
- Enter the OTP code when prompted
- You will receive a password for the account
Save this password securely! If you lose it, you'll need to use the Forgot Password process to reset it.
Note Base URL
On the registration screen, you will see the base URL for UI and API access.
Common Qualys URLs by region:
- US Platform 1:
https://qualysapi.qualys.com - US Platform 2:
https://qualysapi.qg2.apps.qualys.com - US Platform 3:
https://qualysapi.qg3.apps.qualys.com - US Platform 4:
https://qualysapi.qg4.apps.qualys.com - EU Platform 1:
https://qualysapi.qualys.eu - EU Platform 2:
https://qualysapi.qg2.apps.qualys.eu - India Platform 1:
https://qualysapi.qg1.apps.qualys.in - Canada Platform 1:
https://qualysapi.qg1.apps.qualys.ca
Save this URL - it will be used for the integration configuration
Verify Login
Using the username from Step 1 and the password from this step, log in to the Qualys Vulnerability Management UI to verify the account works correctly
Step 3: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Qualys integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Base URL | The base URL from Step 2 | https://qualysapi.qualys.com |
| Username | The randomly generated username from Step 1 | qualys_user_123456 |
| Secret | The password from Step 2 | your-secure-password |
Make sure to use the API URL (not the UI URL). API URLs typically start with qualysapi. rather than qualysguard..
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > Vulnerabilities in RAD Security
- Locate your Qualys integration
- Check the connection status shows as Connected
- Verify vulnerability data is being synced
Your Qualys Vulnerability Management integration is now configured! RAD Security can now import vulnerability findings and correlate them with runtime security events.
What Data is Synced
Once configured, RAD Security will sync the following data from Qualys:
Use Cases
Vulnerability Correlation Correlate Qualys vulnerability scans with runtime security events to identify active exploitation attempts.
Risk Prioritization Prioritize vulnerabilities based on runtime exposure, criticality, and exploitability.
Compliance Validation Verify compliance remediation efforts with runtime validation and monitoring.
Asset Discovery Maintain an up-to-date asset inventory correlated with runtime security data.
Troubleshooting
Security Best Practices
Use Service Accounts Always use a service email account (not personal) to ensure continuity when employees change roles or leave.
Least Privilege Access Use the Reader role — RAD only reads vulnerability findings and never needs scan-capable roles. Only assign necessary asset groups.
Secure Credential Storage Store credentials securely. Never commit them to version control or share via unsecured channels.
Regular Access Reviews Periodically review service account permissions and asset group assignments in Qualys.
Password Management Store the service account password in a secure password manager accessible to your security team.
Monitor API Usage Regularly review API usage in Qualys to detect any anomalous activity.