Qualys Cloud Platform 10.6 (VM/PC) API notification 2
A new release of Qualys Cloud Platform 10.6 (VM/PC) includes an updated API which is targeted for release in December 2020. The specific day will differ depending on the platform. See platform release dates on the Qualys Status page. This API notification provides an early preview into the coming API, allowing you to identify use cases that can leverage this updated API.
What’s New
Policy Export Shows Control Status for Different Control Types and Formats
/api/2.0/fo/compliance/policy/?action=export
/api/2.0/fo/compliance/policy/?action=import
When you export a compliance policy (from the UI or API) we indicate the status for each control in the policy so you know whether the control is disabled or not. We were already showing control status in XML format for service-defined controls, and now you’ll also see the status for user-defined controls. When you export a policy to CSV format, you’ll notice a new column for showing the control status for all control types, including service-defined controls and user-defined controls. This change provides consistency across formats. The control status appears under IS_CONTROL_DISABLE with a value of 1 when the control is disabled and a value of 0 when the control is enabled.
More Regions Supported for EC2 and Cloud Perimeter Scans
/api/2.0/fo/scan/
/api/2.0/fo/scan/compliance/
/api/2.0/fo/scan/cloud/perimeter/job
/api/2.0/fo/schedule/scan/
We support the following new regions when launching vulnerability and compliance scans on EC2 instances, and when launching cloud perimeter scans: Europe (Milan) and Africa (Cape Town). You need to set the input parameter to the respective region and include it in the scan request.
Choose Data Scope for Asset Purge
/api/2.0/fo/asset/host/?action=purge
With this release, we’ve introduced a new input parameter called “data_scope” that allows you to specify the type of data to purge from a host. You can specify “vm” to purge vulnerability data, “pc” to purge compliance data, or “vm,pc” (irrespective of order) to purge both types of data.
More Details in Authentication Reports: Host ID and All Asset Tags
/api/2.0/fo/report/
Now you have the option to include additional details in authentication reports. When you generate an authentication report in the UI (from VM or PC), you’ll see new options for including Host ID and All Asset Tags in the Details Section of the report. These are optional details that are not included by default. The details you pick will appear in all report formats, including XML and CSV.
New SAP IQ Authentication API
/api/2.0/fo/auth/
SAP IQ authentication is now supported for compliance scans (using PC or SCA). The new SAP IQ API (api/2.0/fo/auth/sapiq/) lets you list, create, update and delete SAP IQ authentication records. User permissions for this API are the same as other authentication record APIs.
New Database UDC for SAP IQ
/api/2.0/fo/compliance/posture/info/?action=list
/api/2.0/fo/compliance/control/?action=list
/api/2.0/fo/compliance/policy/?action=export
/api/2.0/fo/subscription/option_profile/pc
We’ve introduced a new Database UDC for SAP IQ. For this new database control type, we added new settings in the compliance option profile. You’ll see API changes for create, update, list, and export option profiles. We’ve also added new elements to the XML output and DTDs for Control List Output, Policy Export Output, Posture Info List Output, Option Profiles, and the ImportableControl.xsd schema.
Option to Scan Multiple Slices in a Single Scan
/api/2.0/fo/subscription/option_profile/
With this release, we have added scan_multiple_slices_per_scanner parameter under scan performance for option profile. This will reduce scan completion time and increase the scanner capacity utilization.
Update to ImportableControl.xsd Schema
The ImportableControl.xsd schema is used when you import and export user defined controls in XML format. In this schema, we increased the maximum length for database UDC SQL statements from 4000 to 32000 characters. This increase will allow for more complex queries in your database UDCs.
Posture Info API – CSV Format now includes Evidence
/api/2.0/fo/compliance/posture/info/
Now when you run the Posture Info API with details=All or details=Light and output_format=csv, the CSV output will include the Posture Evidence section. The Posture Evidence section was only showing up in XML output format in previous releases. Now the output will be consistent between these formats.
Addition of Host ID to Compliance Reports
/api/2.0/fo/report/
Now the Host ID information will be added to the Authentication Report, Policy Report, and Scorecard Reports in these formats (HTML, HTML New, PDF, XML, CSV).