Qualys
Connect Qualys to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Qualys to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Qualys's guide | docs.qualys.com |
Connect with an API token
-
In Qualys:
- Create a dedicated user for Safeguard under Users › User Accounts and give it the Reader role (a User Administrator can create users; Readers can view vulnerabilities and run reports).
- Use that user's username and password in Safeguard.
Where to find the other values:
- Username: The Qualys login name of the user you created.
- Platform: Read the platform identifier inside your Qualys username (for example quays_ab1 is US1, quays2ab1 is US2, quays-ab1 is EU1); Qualys' Platform Identification page maps each identifier to its platform and URL (US1 https://qualysguard.qualys.com, EU1 https://qualysguard.qualys.eu, and so on).
Qualys's public documentation does not cover every step.
Qualys uses username and password (basic auth) for its APIs rather than tokens. The Reader role and the Users > User Accounts location are from Qualys docs, but the exact name of the API access permission checkbox and the add-user dialog steps could not be found on public pages fetched, so those clicks are not sourced. Verification: no fetched page mentions API access for users, so the API access step was removed.
Source: docs.qualys.com, docs.qualys.com, qualys.com, checked 2026-10-07.
The permissions Safeguard needs:
API access,Reader. -
On Compliance › Connectors, open Qualys, click Connect, choose API token and fill in:
Field What to enter Username Required. Password Required. Stored encrypted and never shown again. Platform Required. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Qualys and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 4 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 4 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 4 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks