Qualys VMDR Field Reference
Every Qualys VMDR field RAD stores, the column it lands in, how to filter it, and the severity crosswalk for queries migrating from RAD's normalized bands.
This page maps each Qualys field to the column RAD stores it in and to the way you filter it. It covers the three data types the Qualys VMDR integration writes:
| Data type | Contents |
|---|---|
qualys_detections | Host detections — one row per detection, current state |
qualys_hosts | Host assets from the daily Host List census |
qualys_knowledge_base | QID definitions from the KnowledgeBase |
How to read these tables
- Qualys field is the element in the Qualys API response, using Qualys' own names.
- Column is what you write in a query —
severity:5,is_open:1,cve_uids:"CVE-2026-50646". - Filter label is how the field is presented in the query builder and filter menus. Fields with no label are still stored and returned; they are simply not offered as a pick list.
Column names are the same names Qualys uses, lowercased. When you know the Qualys field, you know the column.
An identifier that does not exist is not an error — the query surface falls back to a text search and returns plausible-looking results. Copy column names from this page rather than guessing them.
Detections — qualys_detections
Identity and grain
A detection is identified by host, QID, port, protocol, SSL flag, FQDN and service. All seven are stored as columns and all seven participate in the row's identity, so two detections that differ only in port or service stay two rows.
| Qualys field | Column | Filter label | Notes |
|---|---|---|---|
HOST/ID | host_id | Host ID | Qualys' host ID |
DETECTION/QID | qid | QID | |
DETECTION/PORT | port | — | -1 when Qualys reports no port |
DETECTION/PROTOCOL | protocol | — | - when absent |
DETECTION/SSL | ssl | — | 0 when absent |
DETECTION/FQDN | fqdn | — | Empty when absent |
DETECTION/SERVICE | service | — | Empty when absent |
| — | id | — | RAD's stable key over the seven components above plus the integration |
| — | timestamp | — | When RAD observed this state |
State
| Qualys field | Column | Filter label | Notes |
|---|---|---|---|
DETECTION/STATUS | status | Status | New, Active, Fixed, Re-Opened, verbatim |
DETECTION/TYPE | type | Detection Type | Confirmed, Potential, Information Gathered |
DETECTION/SEVERITY | severity | Severity | Qualys 1–5, not normalized — see the crosswalk |
DETECTION/IS_IGNORED | is_ignored | — | RAD pulls ignored detections rather than hiding them |
DETECTION/IS_DISABLED | is_disabled | — | Same for disabled |
| — | is_open | Open | The openness answer. 1 when status is New/Active/Re-Opened and the detection is neither ignored, disabled nor absent |
| — | absence_reason | Absence Reason | Empty normally; host_purged or not_in_source when Qualys stopped reporting the detection |
DETECTION/TIMES_FOUND | times_found | — | |
DETECTION/TIMES_REOPENED | times_reopened | — | |
DETECTION/UNIQUE_VULN_ID | unique_vuln_id | — | Qualys' own detection ID, for cross-reference into the console |
DETECTION/RESULTS | results | — | Scan evidence; excluded from list responses, present on the detail record. Capped at 32 KiB with a visible marker |
| — | results_truncated | — | 1 when the cap applied |
Scoring
| Qualys field | Column | Filter label | Notes |
|---|---|---|---|
DETECTION/QDS | qds | QDS | Qualys Detection Score, 1–100 |
DETECTION/QDS@severity | qds_severity | — | Qualys' QDS band |
DETECTION/QDS_FACTORS | qds_factors | — | The full factor set, as JSON |
QDS_FACTORS EPSS factor | epss | EPSS | -1 when Qualys reports no EPSS |
Dates
All eight Qualys clocks are stored under their own names.
| Qualys field | Column | Filter label |
|---|---|---|
FIRST_FOUND_DATETIME | first_found_datetime | First Found |
LAST_FOUND_DATETIME | last_found_datetime | Last Found |
LAST_TEST_DATETIME | last_test_datetime | — |
LAST_UPDATE_DATETIME | last_update_datetime | — |
LAST_FIXED_DATETIME | last_fixed_datetime | Last Fixed |
FIRST_REOPENED_DATETIME | first_reopened_datetime | — |
LAST_REOPENED_DATETIME | last_reopened_datetime | — |
LAST_PROCESSED_DATETIME | last_processed_datetime | — |
Filtering on First Found, Last Found or Last Fixed widens the query window to match, so age and SLA questions work against the Qualys clock rather than against RAD's observation clock.
| Derived | Column | Notes |
|---|---|---|
(LAST_FIXED_DATETIME − FIRST_FOUND_DATETIME) in days | ttr_days | Written only at closure; empty otherwise, and empty values are excluded from avg(). Measures the detection's whole lifetime, not the latest repair episode |
KnowledgeBase attributes copied onto the detection
Copied so you can filter and list without a second query, and refreshed on every re-observation of an open detection.
| Qualys field (KnowledgeBase) | Column | Filter label |
|---|---|---|
VULN/TITLE | title | Title (also full-text searchable) |
VULN/VULN_TYPE | vuln_type | — |
VULN/CATEGORY | category | Category |
VULN/PATCHABLE | patchable | Patchable |
VULN/CVE_LIST/CVE/ID | cve_uids | CVE |
VULN/THREAT_INTELLIGENCE/THREAT_INTEL | rti | Threat Indicator |
VULN/CVSS/BASE | cvss_base | — |
VULN/CVSS_V3/BASE | cvss3_base | — |
cve_uids is an array and is never truncated — a QID that rolls up hundreds of CVEs keeps all of them. Filter it by value (cve_uids:"CVE-2026-50646"); a match on any element matches the row.
These columns are frozen as at closure. A Fixed detection is not re-observed, so its title, CVEs and CVSS scores remain the values that were current on the day it closed.
Host attributes copied onto the detection
| Qualys field (detection response) | Column | Filter label |
|---|---|---|
HOST/IP, falling back to HOST/IPV6 | host_ip | Host IP |
HOST/DNS_DATA/FQDN, falling back to HOST/DNS then HOST/OS_HOSTNAME | host_fqdn | Host Name (also full-text searchable) |
HOST/NETBIOS | host_netbios | — |
HOST/OS | host_os | — |
HOST/TAGS/TAG/NAME | host_tags | Host Tag |
HOST/TRACKING_METHOD | host_tracking_method | — |
Tag names keep their exact case: Qualys treats two tags differing only in case as two tags, and so does RAD.
| Everything else Qualys returned | Column |
|---|---|
The remaining DETECTION children, unmodified | raw |
Hosts — qualys_hosts
One row per host, refreshed by the daily census. The census requests the Basic detail set — that choice is what makes a full-subscription census affordable within the API quota, and it is why a few columns below are always empty.
| Qualys field | Column | Filter label | Notes |
|---|---|---|---|
HOST/ID | host_id | Host ID | |
HOST/ASSET_ID | asset_id | — | The CSAM asset ID |
HOST/QG_HOSTID | qg_hostid | — | Cloud Agent UUID; how RAD tells a re-identified host from a purged one |
HOST/IP | ip | IP | |
HOST/IPV6 | ipv6 | — | |
HOST/TRACKING_METHOD | tracking_method | Tracking Method | IP, DNS, NETBIOS, Cloud Agent, EC2, verbatim |
HOST/DNS | dns | — | Full-text searchable |
HOST/DNS_DATA/HOSTNAME | dns_hostname | — | |
HOST/DNS_DATA/DOMAIN | dns_domain | — | |
HOST/NETBIOS | netbios | — | Full-text searchable |
HOST/OS | os | OS | |
| — | os_cpe | — | Always empty — not emitted by the Host List API |
HOST/NETWORK_ID | network_id | — | |
| — | network_name | — | Always empty — not emitted by the Host List API |
HOST/TAGS/TAG/NAME | tags | Tag | |
HOST/TAGS/TAG/TAG_ID | tag_ids | — | Index-aligned with tags |
HOST/ASSET_GROUP_IDS | asset_groups | Asset Group | Group IDs, not titles — the Host List API returns IDs |
HOST/CLOUD_PROVIDER | cloud_provider | Cloud Provider | |
HOST/METADATA region attribute | cloud_region | — | Populated for EC2; sparse for other providers |
HOST/METADATA account attribute | cloud_account | — | Populated for EC2; sparse for other providers |
HOST/CLOUD_RESOURCE_ID | cloud_resource_id | — | |
HOST/EC2_INSTANCE_ID | ec2_instance_id | — | |
| — | mac | — | Reserved, always empty — see wave-2 fields |
HOST/SERIAL_NUMBER | serial_number | — | Full-text searchable |
HOST/HARDWARE_UUID | hardware_uuid | — | |
HOST/AGENT_STATUS | agent_status | Agent Status | Cloud Agent state, e.g. Inventory Scan Complete |
HOST/LAST_BOOT | last_boot | — | |
HOST/LAST_ACTIVITY | last_activity | — | Widens the query window |
HOST/LAST_VM_SCANNED_DATE | last_vm_scanned_date | — | Widens the query window |
HOST/LAST_VM_SCANNED_DURATION | last_vm_scanned_duration | — | -1 when absent |
HOST/LAST_VM_AUTH_SCANNED_DATE | last_vm_auth_scanned_date | — | Empty means no authenticated scan — treat that host's results as surface-level |
HOST/FIRST_FOUND_DATE | first_found_date | — | |
HOST/TRURISK_SCORE | trurisk_score | — | 0–1000; -1 when absent |
HOST/ASSET_CRITICALITY_SCORE | asset_criticality_score | — | 1–5; -1 when absent |
HOST/TRURISK_SCORE_FACTORS | trurisk_score_factors | — | JSON |
The remaining HOST children | raw | — |
A host purged from Qualys is not flagged. RAD stops re-writing its row, so it ages out of windowed reads, and its detections receive an absence_reason so they stop counting as open.
KnowledgeBase — qualys_knowledge_base
One row per QID, scoped to your integration rather than shared globally — severity and threat intelligence can be subscription-specific, so your KnowledgeBase is the one your subscription sees.
Query it by qid when you need the full write-up for a detection. Detection rows already carry the short attributes.
| Qualys field | Column | Filter label | Notes |
|---|---|---|---|
VULN/QID | qid | QID | |
VULN/TITLE | title | Title | Full-text searchable |
VULN/SEVERITY_LEVEL | severity | Severity | Qualys 1–5 |
VULN/VULN_TYPE | vuln_type | Vuln Type | Vulnerability, Potential Vulnerability, … |
VULN/CATEGORY | category | Category | |
VULN/PATCHABLE | patchable | Patchable | |
VULN/PCI_FLAG | pci_flag | PCI Flag | |
VULN/CVE_LIST/CVE/ID | cve_uids | CVE | |
VULN/CVSS/BASE | cvss_base | — | -1 when absent |
VULN/CVSS/TEMPORAL | cvss_temporal | — | -1 when absent |
VULN/CVSS/VECTOR_STRING | cvss_vector | — | |
VULN/CVSS_V3/BASE | cvss3_base | — | -1 when absent |
VULN/CVSS_V3/TEMPORAL | cvss3_temporal | — | -1 when absent |
VULN/CVSS_V3/VECTOR_STRING | cvss3_vector | — | |
VULN/THREAT_INTELLIGENCE/THREAT_INTEL | rti | Threat Indicator | Present only when Threat Protection is enabled for the subscription |
VULN/DIAGNOSIS | diagnosis | — | Detail record only; full-text searchable |
VULN/CONSEQUENCE | consequence | — | Detail record only; full-text searchable |
VULN/SOLUTION | solution | — | Detail record only; full-text searchable. Capped at 64 KiB with a visible marker |
| — | solution_truncated | — | 1 when the cap applied |
VULN/SOFTWARE_LIST/SOFTWARE/PRODUCT | software_products | — | |
VULN/SOFTWARE_LIST/SOFTWARE/VENDOR | software_vendors | — | |
VULN/VENDOR_REFERENCE_LIST/VENDOR_REFERENCE/ID | vendor_refs | — | |
VULN/BUGTRAQ_LIST/BUGTRAQ/ID | bugtraq_ids | — | |
VULN/DISCOVERY/REMOTE | discovery_remote | — | 1 when the QID is remotely detectable |
VULN/DISCOVERY/AUTH_TYPE_LIST/AUTH_TYPE | auth_types | — | Authentication types the QID needs |
VULN/SUPPORTED_MODULES | supported_modules | — | |
VULN/PUBLISHED_DATETIME | published_datetime | — | |
VULN/LAST_SERVICE_MODIFICATION_DATETIME | last_service_modification_datetime | — | |
VULN/CODE_MODIFIED_DATETIME | code_modified_datetime | — | |
The remaining VULN children | raw | — |
CVSS v2 and v3 stay in separate columns because Qualys keeps them as separate blocks. There is no merged "CVSS score" column, and a QID may carry either, both or neither.
Severity crosswalk
RAD's shared vulnerability views present a normalized severity band (Critical, High, Medium, Low). The Qualys VMDR integration does not: severity is the Qualys 1–5 level exactly as Qualys scanned it.
Qualys' own definitions:
| Qualys severity | Qualys name | Meaning |
|---|---|---|
| 5 | Urgent | Intruders can easily gain control of the host, which can lead to the compromise of your entire network security |
| 4 | Critical | Intruders can possibly gain control of the host |
| 3 | Serious | |
| 2 | Medium | |
| 1 | Minimal |
The normalized band was derived from the Qualys level by adding one and capping at the top band. That is why the two ladders do not line up:
Qualys severity | Normalized band in the shared views | Native query |
|---|---|---|
| 5 (Urgent) | Critical | severity:5 |
| 4 (Critical) | Critical | severity:4 |
| 3 (Serious) | High | severity:3 |
| 2 (Medium) | Medium | severity:2 |
| 1 (Minimal) | Low | severity:1 |
Every band shifts by one rung. A dashboard tile that counted normalized Critical becomes severity:5 OR severity:4 — and if you translate it to severity:5 alone, the tile drops by the whole Qualys-4 population. In the same change, the Medium/Low tiles grow, because Qualys 3 and 2 move down out of High and Medium.
Translate the whole ladder in one pass. Migrating a single tile makes the dashboard look broken.
Two other scores are available per detection and answer different questions:
- QDS (
qds, 1–100) is Qualys' own per-detection risk score, built from threat intelligence and mitigating controls. It is not a rescaled severity and routinely disagrees with it — a severity 5 with no known exploit can score low. - EPSS (
epss) is the exploit-prediction probability, when Qualys supplies it.
Sorting by severity and sorting by qds will not produce the same list. Pick the one that matches the question you are asking.
Fields planned for a later wave
| Field | Status |
|---|---|
| MAC address | The Host List API does not emit it. The mac column is reserved and stays empty; populating it requires the Qualys Asset Management (QPS) API and is planned as a follow-up. No schema change will be needed when it lands. |
| Network interface inventory | Same source, same follow-up. Per-interface addresses are not available from the APIs this integration uses. |
| Reports (list and download) | The Qualys Report Share surface is not part of this integration and is committed for a follow-up release. The date is confirmed in your cutover brief. |
| Device inventory enrichment | Where host assets are mirrored into RAD's shared device inventory, those rows carry identity fields only. Tags, asset groups and TruRisk scores stay on qualys_hosts. Mirroring tags onto the device record is an optional follow-up, not part of this release. |
Query horizon
Queries are windowed, and the window reaches back 90 days from whichever Qualys clock you filter on. first_found_datetime, last_found_datetime and last_fixed_datetime widen the window for you.
Beyond 90 days the query surfaces do not reach: "everything we fixed last year" and multi-quarter MTTR trends are out of scope. Full history is retained in storage and can be queried by RAD support on request.