Overview

The Qualys TotalCloud Plugin discovers cryptographic assets (certificates, keys, and secrets) from cloud infrastructure managed by Qualys CloudView. It integrates with Qualys TotalCloud's compliance and security posture management platform to extract crypto assets from multiple cloud providers.

Supported Cloud Providers:

  • AWS (Amazon Web Services)
  • Azure (Microsoft Azure)
  • GCP (Google Cloud Platform)

Note: OCI (Oracle Cloud Infrastructure) is not currently supported.

Multi-Connector Support: The plugin automatically scans across all cloud connectors configured in your Qualys account, discovering crypto assets from multiple AWS accounts, Azure subscriptions, and GCP projects in a single scan execution.

The plugin uses Qualys CloudView's dual API approach to comprehensively discover crypto assets:

  • Inventory API: Retrieves resources by type (e.g., AWS Secrets, CloudFront distributions, Azure Key Vault resources)
  • Evaluations API: Discovers crypto assets through compliance control evaluations

Features

  • Multi-Cloud Discovery: Scans AWS, Azure, and GCP from a single plugin
  • Dual API Strategy: Combines Inventory and Evaluations APIs for comprehensive coverage
  • Incremental Scanning: Time-based filtering using Qualys relative time syntax (now-5m, now-2h, now-3d)
  • Intelligent Filtering: Client-side control filtering focuses on crypto-relevant compliance checks
  • Resource Type Detection: Automatically classifies discovered assets as certificates, keys, or secrets
  • Standardized Output: Consistent JSON format with URNs and rich metadata
  • State Tracking: Persists scan state for efficient delta scans
  • Secure Credentials: Password fields masked in UI schema

When the scan command-line option is executed, the plugin validates the input configuration and produces the scan output.

  • This plugin needs to emit the cryptographic assets from the Qualys TotalCloud endpoints.
  • List of assets - Certs, keys, secrets from AZ, AWS, GCP clouds
  • Can accept input via stdin or a config file
  • The output is emitted to stdout or the output file
  • The output should be in a standard format, as per plugin documentation
  • All the assets should have a urn, url, plugin id, plugin version, type, result type
  • If applicable, plugin should output the state and should be able to filter scan results based on state if available in input