This plugin configuration supports the following optional settings:

Usage

Get Plugin Information

./qualys-container-security-plugin info

Returns plugin metadata including version, description, and contact information.

Get Configuration Schema

./qualys-container-security-plugin schema

Returns the JSON schema describing required configuration fields and validation rules.

Get UI Schema

./qualys-container-security-plugin uischema

Returns the UI schema for form field ordering in configuration interfaces.

Test Connectivity

Verify that your configuration works and credentials are valid:

cat config.json | ./qualys-container-security-plugin test

This performs a lightweight authentication check and validates the Qualys API is accessible.

Success Response:

{
  "result_type": "test",
  "plugin_id": "qualys-container-security-plugin",
  "plugin_version": "1.0.0",
  "data": {
    "test_status": "COMPLETE"
  }
}

Run Scan

Discover all secrets in container images:

cat config.json | ./qualys-container-security-plugin scan

Output: Multiple JSON objects (one per discovered secret), each with:

• result_type - Always "scan"
• plugin_id - Plugin identifier
• plugin_version - Plugin version
• data - Object containing secret details:
  • type - Always "secret"
  • timestamp - ISO8601 discovery timestamp with timezone
  • urn - Unique resource name (intrinsic identifier, content-based fingerprint)
  • url - Extrinsic locator (registry URL). A #<file_path> fragment is included only when file path evidence is available.
  • extra - Object with metadata:
    • category - Secret type (e.g., "Github", "AWS Credentials")
    • severity - Risk level (e.g., "critical", "high", "medium", "low")
    • name - Secret type name (e.g., "GitHub Personal Access Token")
    • file_path - File path where secret was found (if available)
    • layer_sha - SHA of the container layer containing the secret
    • rule_uuid - Detection rule identifier
    • last_modified_date - Last update timestamp from Qualys (RFC3339 when available)
    • start_line - Line number in file (optional, appears only if provided by Qualys)