Skip navigation

EU Platform

8 Posts tagged with the api tag
0

A new release of QualysGuard AM API is scheduled to be released in production on the QualysGuard EU Platform on April 1st, 2014 between 12 PM PDT (19:00 UTC) and 6:00 PM PDT (01:00 UTC next day).

 

The deployment is completely transparent to users and will require no downtime.

 

Release Details: QualysGuard AM API update includes the addition of the Asset Management and Tagging API v2. The addition of this API will allow customers to access new Tag API, Host Asset API, Asset API and Host Instance Vulnerability API functionality via one API. For more information on new features see QualysGuard API Notification 

 

To continue to receive notifications by email, please subscribe at https://community.qualys.com/community/notifications-eu

4

A new release of QualysGuard, Version 7.13 will be available in production on the QualysGuard EU Platform on February 20, 2014. The deployment is completely transparent to users and will require no downtime. The release will occur between 12 PM PDT (20:00 UTC) and 6:00 PM PDT (02:00 UTC next day).

 

QualysGuard VM and PC version 7.13 includes the following features:

Vulnerability Scorecard Report updates, New Compliance Scorecard Report, MS SQL Authentication – Auto Discover Database Instances, and multiple API enhancements (Ability to download API v2 CSV reports without headers, New HTTP Authentication options, New "Policy Merge” feature,  Policy Report XML now includes custom control references, Apache Authentication Support for multiple instances per host)

 

See QualysGuard 7.13 New Features and QualysGuard® 7.13 API Notification - 15 Day for more details.

 

To continue to receive notifications by email, please subscribe at EU Platform.

0

A new release of QualysGuard®, Version 6.24, will be available in production on Tuesday, February 7, 2012. This release is completely transparent to users and will require no scheduled downtime. The release will occur between  20:00 GMT(12 PM PST) and 02:00 AM GMT next day (6 PM PST).

 

QualysGuard 6.24 includes several enhancements including Virtual Scanners general availability and enhancements to Policy Compliance, API and platform capabilities:

 

QualysGuard Virtual Scanner Availability:

 

QualysGuard 6.24 includes the full release of the QualysGuard Virtual Scanner Appliance. The consultant version is easily deployed onto VMware (Workstation, Fusion, Player), Oracle VirtualBox, and other virtualization platforms, with a user console wizard allowing for a quick initial setup. Also available is an enterprise version provided as a packaged VMware vApp that can be effortlessly deployed into VMware vSphere and vCloud environments, requiring no direct console access to the virtual appliance itself.

 

QualysGuard Virtual Scanner Appliances are available to licensed customers for direct download from their QualysGuard account. For more on licensing, please contact your Qualys Technical Account Manager. For details on provisioning the virtual appliance, please refer to the appropriate user guide in the online help and follow the Qualys Community at https://community.qualys.com.

 

QualysGuard Enhancements:

  • Thycotic Server Integration: QualysGuard 6.24 includes integration with Thycotic Secret Server for authentication against Windows and UNIX assets, permitting customers to keep all authentication credentials used for scanning within their network perimeter.

secret server.jpg

 

  • OS CPE Support: QualysGuard 6.24 allows customers to display operating system information in Common Platform Enumeration (CPE) format, allowing for easier correlation and integration with products supporting that standard.

    cpe.jpg

 

 

 

QualysGuard Policy Compliance Enhancements:

 

  • Host Statistics in Policy Report: The Policy Report includes a new section called Host Statistics which includes a list of hosts in the policy with the percentage of control instances that passed on each host.

 

host statistics report.jpg

 

 

 

 

QualysGuard API Enhancements:

  • Final CVSS Score Added to Asset Data Report DTD: The final CVSS score calculated for each vulnerability detection now appears in the automatic asset data report DTD (asset_data_report.dtd) in the <CVSS_Final> element when the CVSS scoring feature is enabled for the user’s subscription.
  • New Share PCI Scan API: The new Share PCI Scan V2 API (/api/2.0/fo/scan/pci/) provides an automated way to share (export) finished PCI scans to PCI Merchant accounts and check the export status. PCI scans are vulnerability scans that were run with the option profile “Payment Card Industry (PCI) Options”.

 


 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. To receive more information on QualysGuard 6.24, please visit the Qualys Community at https://community.qualys.com or contact your Technical Account Manager or Qualys' Technical Support Department at support@qualys.com.

0

A new release of QualysGuard®, Version 6.23, will be available in production on Thursday, December 15th 2011. This release is completely transparent to users and will require no scheduled downtime. The release will occur between 20:00 GMT (12 PM PST) and 02:00 AM GMT next day (6 PM PST).

 

QualysGuard 6.23 includes the following enhancements to VM, Policy Compliance, API and platform capabilities:

QualysGuard Enhancements:

  • Oracle SID or Service Name Authentication: QualysGuard 6.23 introduces the ability to identify Oracle instances by either SID or Service Name, allowing customers to easily perform authenticated scanning of Oracle instances.
    Screen Shot 2011-11-23 at 7.03.06 AM.png
  • Remove IPs from Subscriptions: QualysGuard 6.23 allows users with Manager roles to remove IPs from their subscription without requiring interaction with Qualys Support, reducing the time and effort required to eliminate unneeded or invalid IPs from QualysGuard.
    Screen Shot 2011-11-23 at 7.03.54 AM.png
  • Additional New Scanner Service Icon: QualysGuard 6.23 adds an additional icon for the status of connectivity to New Scanner Services at the Qualys SOC. The addition of a Not Used icon helps clarify when connectivity issues require immediate action, or can be safely disregarded.
    Screen Shot 2011-11-23 at 7.04.41 AM.png

QualysGuard Vulnerability Management Enhancements:

  • Improved Report Trending Data: With QualysGuard 6.23, trending reports have been changed to provide more accurate remediation metrics. Reports will now include data for vulnerabilities that have been fixed in the timeframe specified in your scan report template, even if the detection occurred prior to that window.

QualysGuard Policy Compliance Enhancements:

  • Create Policy using a Golden Image: With QualysGuard 6.23, you can now create a policy by selecting a host to act as a “Golden Image” for the new policy. During policy creation, the scan results of the "Golden Image" are used to set the expected values in your new policy.

Golden Image.png

  • Policy Editor Improvements: QualysGuard 6.23 introduces several improvements to the Policy Editor including enhanced navigation using an outline, collapsible sections within the policy, and easier management of controls. The new policy editor also allows you to switch back to the classic policy editor.

Policy Editor.png

  • Deprecated Controls: To continually improve and simplify the technical controls used in Policy Compliance, QualysGuard 6.23 allows controls to be deprecated and replaced with new controls. Each deprecated control has one or more replacement controls. A new workflow is provided for replacing deprecated controls within your existing policies.

Control Deprecation.png

QualysGuard API Enhancements:

  • Vendor and Product Added to KnowledgeBase V2 API: QualysGuard 6.23 enhances the KnowledgeBase API v2 (api/2.0/fo/knowledge_base/vuln/?action=list) to include the new elements <VENDOR> and <PRODUCT>.
  • Deprecated Control Flag: With QualysGuard 6.23, the <DEPRECATED> flag has been added to the following DTD: Control List Output, Policy List Output, Posture Info Output.
  • Support for Service Name in Oracle Records: In QualysGuard 6.23 the Oracle Authentication API (/api/2.0/fo/auth/oracle/) now supports the servicename input parameter, and XML output includes the <SERVICENAME> element.
  • IPv6 Asset Management: QualysGuard 6.23 provides the new IPv6 Asset API (/api/2.0/fo/asset/ip/v4_v6) for Manager users to manage and scan IPv6 hosts using the API. Additionally, the Detection API (/api/2.0/fo/asset/host/vm/detection/) has been enhanced with the <IPV6> element to indicate the IPv6 address of hosts scanned.

 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. To receive more information on QualysGuard 6.23, please visit the Qualys Community at https://community.qualys.com or contact your Technical Account Manager or Qualys' Technical Support Department at support@qualys.com.

0

A new release of QualysGuard®, Version 6.22, will be available in production on Tuesday, October 4th 2011. This release is completely transparent to users and will require no scheduled downtime. The release will occur between 12 PM PDT (19:00 GMT) and 6 PM PDT (01:00 AM GMT next day).

 

QualysGuard 6.22 includes the following enhancements:

QualysGuard Enhancements:

  • Exclude Hosts per Scan: QualysGuard 6.22 introduces the ability to exclude hosts on a per scan basis. Any user with scanning privileges can exclude hosts this way. This feature is supported for all IP-based scans, including vulnerability scans, compliance scans and FDCC scans.  When launching or scheduling a scan, enter the scan target in the Target Hosts section, and then enter the IP addresses/ranges you want to exclude from the scan in the Exclude IPs/Ranges field.

Exclude Hosts per Scan.png

QualysGuard Vulnerability Management Enhancements:

  • Improved VM Dashboard: With QualysGuard 6.22, an improved Vulnerability Management (VM) Dashboard is now available in the New UI. The VM Dashboard provides a one-page summary of your overall security posture.

VM Dashboard.PNG

  • Improved Oracle Patch (OPatch) Detections: OPatch is an Oracle-supplied utility that helps Oracle users apply and rollback patches for Oracle software. QualysGuard 6.22 provides the option to use the OPatch utility to obtain Oracle patch information during Oracle authenticated scans on Unix hosts.  To enable OPatch, create/edit an Oracle authentication record and provide the proper OPatch parameters:

OPatch.png

  • Patch Report Enhancements: With QualysGuard 6.22, the patch report template includes two new enhancements:
    1. The ability to specify how you want the patch severity calculated.
      Patch Severity.png
    2. The ability to selectively filter patches.
      Selective Patch Filtering.png
  • Published Date Added to KnowledgeBase: The KnowledgeBase includes a new column in QualysGuard 6.22 that shows the published date for each vulnerability. The published date is the date the vulnerability was added to the KnowledgeBase.

Published Date - Knowledgebase.pngThe search criteria has also been updated to include the published date for vulnerabilities:Published date - Search.png

QualysGuard Policy Compliance Enhancements:

  • PC Dashboard: QualysGuard 6.22 introduces a Policy Compliance (PC) Dashboard in the New UI. The PC Dashboard provides a one-page summary of your overall compliance status across all policies in your account.

PC Dashboard.png

  • Policy Summary Report: QualysGuard 6.22 also introduces a new Policy Summary report in the New UI.  The new Policy Summary provides a one-page summary of your compliance status for a specific policy. You can view the Policy Summary from the Reports section (Reports > Policy Summary) or link to it from the PC Dashboard (double-click any policy title under Top 5 Passing/Failing Policies).

Policy Dashboard.png

  • Policy Import/Export: QualysGuard 6.22 introduces the ability to import a compliance policy into your account from an XML file and export a compliance policy from your account to an XML file.  To import a policy directly into your account from an XML file, select New >Import Compliance Policy >Import from XML file from Policies:

Policy Import - Large.pngTo export a policy from your account, select the policy and click Export:Policy Export - Large.png

QualysGuard API Enhancements:

  • Exclude Hosts per Scan: With the introduction of the Exclude Hosts per Scan feature in QualysGuard 6.22, the scan.php V1 API and scheduled_scans.php V1 API have been updated to support a new, optional input parameter: "exclude_ip_per_scan".  This parameter takes a comma seperated list of IP addresses/ranges.  In addition, two new V2 APIs have been created to support this new feature:
    1. Excluded Hosts List (api/2.0/fo/asset/excluded_ip/?action=list) allows API users to request a list of excluded hosts.
    2. Excluded Hosts Change History (api/2.0/fo/asset/excluded_ip/history/?action=list) allows API users to request the change history for excluded hosts in the user’s subscription.
  • Asset Group Filtering for Policy Reports: With QualysGuard 6.22, the launch report V2 API (api/2.0/fo/report/?action=launch) has been updated to support a new, optional input parameter: "asset_group_ids".  This parameter takes a comma seperated list of Asset Group IDs.

 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. To receive more information on QualysGuard 6.22, please visit the Qualys Community at https://community.qualys.com or contact your Technical Account Manager or Qualys' Technical Support Department at support@qualys.com.

0

A new release of QualysGuard®, Version 6.18 Update, will be available in production on Thursday, April 28th 2011. This release is completely transparent to users and will require no scheduled downtime. The release will occur between 12 PM PDT (19:00 GMT) and 6 PM PDT (01:00 AM GMT next day).

 

QualysGuard 6.18 Update includes the following enhancements:

QualysGuard Enhancements:

  • API Processes Log: For QualysGuard 6.18 Update, a new API Processes Log has been created for logging API activities.  These API activities will no longer be included in the Activity Log within QualysGuard.  This new log is available from the Activity Log Tool by selecting View, Recent API Calls.

Recent API Calls.png

QualysGuard Vulnerability Management Enhancements:

  • Disable Virtual Patches and Mitigating Controls: For QualysGuard 6.18 Update, a new checkbox has been added to the scan report template under Detailed Results, Solution called Virtual Patches and Mitigating Controls.  By unselecting this checkbox, Virtual Patches and Mitigating Controls from 3rd party solutions will not be included in the reports.

Virtual Patches.png

QualysGuard API Enhancements:

  • Detection API - CSV Output: QualysGuard 6.18 Update added CSV output support for the detection API.  This change allows host records to be retrieved in CSV.
  • API Concurrency/Rate Limit Information: For QualysGuard 6.18 Update, six new HTTP headers were added to the QualysGuard APIs to identify concurrency and rate limits.  These new HTTP headers will provide actual API usage statistics, quotas, and limits.

 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. To receive more information on QualysGuard 6.18 Update, please visit the Qualys Community at https://community.qualys.com or contact your Technical Account Manager or Qualys' Technical Support Department at support@qualys.com.


0

A new release of QualysGuard®, Version 6.18, will be available in production on Tuesday, April 12th 2011. This release is completely transparent to users and will require no scheduled downtime. The release will occur between 12 PM PDT (19:00 GMT) and 6 PM PDT (01:00 AM GMT next day).

 

QualysGuard 6.18 includes the following enhancements:

QualysGuard Enhancements:

  • SNMP v2c/v3 Support: For QualysGuard 6.18, the SNMP authentication feature has been enhanced to provide users the ability to enter login credentials for authenticating to SNMPv2c and SNMPv3.

QualysGuard Vulnerability Management Enhancements:

  • PCI Vulnerability Flag Added to Scan Reports: In QualysGuard 6.18, vulnerability details in scan results and template-based scan reports now include the element <PCI_FLAG> that indicates whether the vulnerability must be fixed in order to pass a PCI compliance scan.This information helps users to immediately determine which vulnerabilities must be fixed for PCI compliance goals without having to run additional PCI compliance scans.

QualysGuard Policy Compliance Enhancements:

  • Improvements to Policy Editor and Reporting: For QualysGuard 6.18, improvements were made to the policy editor and policy reporting. Improvements include: 1) new fixed value checkboxes in the policy editor, 2) text input fields automatically resize as you type, and 3) formatting and layout enhancements for better readability in your policy editor and reports.

All controls fall into one of the following categories:

    1. The control only allows user-customized criteria. User must select the operator, cardinality and enter an expected value. This is how controls work prior to this release.
    2. The control only allows fixed value selections. User must select/clear checkboxes.
    3. The control allows a combination of user-customized criteria and fixed value selections.

QualysGuard API Enhancements:

  • Authentication API Updates for SNMPv2c andSNMPv3: For QualysGuard 6.18, updates were made to the SNMP scan authentication API to add support for SNMPv2c and SNMPv3. Users can now create and update authentication records for these newly supported SNMP versions. SNMP records created prior to this release are are set to SNMPv1 by default.

The/api/2.0/fo/auth/snmp resource is used to manage SNMP authentication records.  For this release, changes were made to input parameters used to add or edit an SNMP record (action=create and action=update) and the SNMP authentication list DTD (auth_snmp_list_output.dtd).

  • PCI Flag Added to Asset Data Report: For QualysGuard 6.18, updates were made to the XML output for QualysGuard reports to reflect the PCI status for each vulnerability listed.  A PCI flag value of “1” indicates that the vulnerability must be fixed to pass a PCI compliance scan.  This information is shown in the <PCI_FLAG> element in the Asset Data Report DTD (asset_data_report.dtd).
  • Map Title Added to Map Report List: For QualysGuard 6.18, updates were made to the map report list API to include the title of the map report.  This information is shown in the <TITLE> element in the Map report list DTD (map_report_list.dtd).
  • Compliance Policy Report XML: For QualysGuard 6.18 improvements were made to the policy editor and policy reporting.  Updates were made to the compliance policy report XML. Changes were made to the compliance policy report DTD (compliance_policy_report.dtd). The policy report XML is returned when you download a saved policy report using the Report Share API or the QualysGuard user interface.
  • Compliance Posture Information Output XML: For QualysGuard 6.18, improvements were made to the policy editor and policy reporting. Updates were made to the compliance posture information output XML. Changes were made to the compliance posture information DTD (posture_info_list_output.dtd). The compliance posture information output XML is returned from an API request for compliance policy posture information.

 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. To receive more information on QualysGuard 6.18, please visit the Qualys Community at https://community.qualys.com or contact your Technical Account Manager or Qualys' Technical Support Department at support@qualys.com.

0

Dear customers:

 

A new release of QualysGuard®, Version 6.17, will be available in production on Wednesday, March 2nd 2011. This release is completely transparent to users and will require no scheduled downtime. The release will occur at 3 PM PST (23:00 GMT).

 

QualysGuard 6.17 includes the following enhancements:

 

QualysGuard Vulnerability Management Enhancements:

  • Trend Micro Virtual Patch: QualysGuard 6.17 correlates Trend Micro Virtual Patching with QualysGuard-detected vulnerabilities, allowing users to identify and prioritize additional remediation options to reduce risk.  Virtual Patching information is available for Trend Micro Deep Security and Trend Micro OfficeScan products.
  • PCI Linked Account Status: QualysGuard 6.17 provides users of QualysGuard integrated access with QualysGuard PCI 5.0 to view and report on the current compliance status and upcoming due dates for all linked accounts, providing a centralized view of PCI compliance efforts.

QualysGuard Policy Compliance Enhancements:

  • Filtering Frameworks: QualysGuard 6.17 provides the ability to filter or limit the number of frameworks available within the Policy Compliance module.  This enhancement allows customers to filter the frameworks either at the subscription level, affecting all users, or at the report template level, affecting specific reports only.  In addition, the subscription level filter will also filter the frameworks from the control API, allowing customers to extract only the relevant frameworks for their business needs.
  • Cisco IOS: QualysGuard 6.17 introduces configuration scanning support of Cisco IOS 12.x and 15.x within the Policy Compliance module.  This enhancement allows customers to authenticate to Cisco IOS devices via SSH and analyze the running configuration.  A new authentication record for Cisco IOS has been added within QualysGuard to support this enhancement.
  • FDCC Enhancements: Support for Windows 7 and Internet Explorer 8. QualysGuard 6.17 adds Security Content Automation Protocol (SCAP) scanning support for Windows 7, Windows 7 Firewall, and Internet Explorer 8.  This enhancement supports the United States Government Configuration Baseline (USGCB) content published by the National Institute of Standards and Technology (NIST) for these technologies.

QualysGuard API:

  • Detection API: This release includes a new “detection” extension to the version 2 API that is available via following URL:https://qualysapi.qualys.com/api/2.0/fo/asset/host/vm/detection/.   This gives API users the ability to obtain the most current  vulnerability data (“automatic” data) associated to host assets in a XML  format that can be easily imported into third party solutions.  The  detection API is a recommended replacement for other existing API calls  such as “asset_range_info.php”, “asset_data_report.php”,  “asset_search.php” and “get_host_info.php”.

 

Full release notes will be available to customers from within the Resources section of your QualysGuard account. Feel free to contact your Technical Account Manager or Qualys' Technical Support Department (support@qualys.com) for more information about this release.