Qualys Cloud Platform API notification 10.16 (VM/PC) API notification 2

A new release of Qualys Cloud Platform 10.16 (VM/PC) includes an updated API which is targeted for release in December 2021. The specific day will differ depending on the platform. See platform release dates on the Qualys Status page. This API notification provides an early preview into the coming API, allowing you to identify use cases that can leverage this updated API.

What’s New
STIG ID added to STIG Based Report (CSV Format)
/api/2.0/fo/report/?action=fetch
Now when you run the Compliance STIG Based Report from the UI, you’ll see STIG IDs in the CSV report output. This allows you to sort STIG requirements by STIG ID. There is a one-to-one mapping between a STIG ID and a STIG Rule/Rule ID. This advanced notification is intended to inform you of new CSV columns in the report, so you can make any changes necessary to correctly parse the report data.

API Vault Support added for IBM DB2 Authentication Records
/api/2.0/fo/auth/ibm_db2/
We already support vaults for IBM DB2 authentication records from the UI. Starting in this release, we’ll also support vaults for IBM DB2 authentication records from the API. This means that you can specify a vault when creating/updating a IBM DB2 authentication record using the API and you’ll see vault information when listing records using the API.

Updates to Cloud Asset Metadata Fields in Host Based Scan Reports
/api/2.0/fo/report/
/api/2.0/fo/report/template/scan/
We made several updates related to cloud asset metadata shown in Host Based Scan Reports.

New Option to Scan Disconnected ESXi Hosts via vCenter
/api/2.0/fo/auth/vmware/
Now users can scan ESXi hosts without sending any scan traffic directly to the ESXi hosts. To achieve this, we added a new option to the VMware ESXi authentication record that allows users to specify that hosts are disconnected (is_disconnect=1). This option is only supported when you scan the ESXi hosts through vCenter (login_type=vcenter) and is only supported for compliance scans.

Invalid EC2 Instance IDs Skipped at Scan Launch
/api/2.0/fo/scan/ (action=launch)
Now when you launch an EC2 scan and specify EC2 instance IDs as part of the scan target, we will identify and skip any invalid instances and continue the scan on the valid instances. Previously, the entire scan would have been blocked if an instance ID specified as part of the scan target was considered invalid.

The release notes are here: https://www.qualys.com/docs/release-notes/qualys-cloud-platform-10.16-api-release-notes.pdf