Threat & Vulnerability · Integration
Qualys
Add Qualys to your product for your customers, and give your AI agents governed access to it.
Qualys tells a customer what is exposed across their estate, so the records that matter are assets, the detections against them keyed by QID, the scans that found them and the asset tags that organise the whole thing. An embedded Qualys integration is how your product turns that into work someone actually does. Two facts shape the build. Each subscription lives on a specific Qualys platform, so the API host differs per customer and cannot be a constant in your code. And detections recur: the same QID comes back on every scan of the same asset, so records are deduplicated per detection rather than per event, otherwise a weekly scan fills your product with copies. Rate limits are per subscription, so a first import is throttled deliberately.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let each customer connect their own Qualys subscription, including the platform their account sits on, so the API host is configuration rather than a constant.
Read asset inventory and the detections against each asset, so remediation work in your product lands on a real owner.
Launch or read a scan and its results, so your product reports on what was actually assessed rather than what was requested.
Scope what your product shows by the customer's own asset tags, since tagging is how Qualys estates are organised.
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
An agent lists the detections open on an asset group and explains which ones are severity-critical.
An agent reads a scan's results and reports what changed since the previous run.
An agent updates a detection's status within governed permissions, with each change attributed.
Example prompt
Which assets still have critical detections open after last night's scan, and who owns them?
Set up Qualys in 4 steps
- 01Enable the Qualys connector in your fastn dashboard.
- 02Have each customer supply credentials for their own subscription, along with the Qualys platform their account is hosted on.
- 03Map the asset, detection and scan fields your product uses, and decide which asset tags scope what it shows.
- 04Call it from your product and expose the same connection to your agents through the MCP gateway.
Why teams use the Qualys integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a Qualys integration without building it. Your customers connect their own Qualys account inside your product and work their findings, detections and assets there, with no per-customer code on your side.
- Handle the part that actually costs time: a rescan re-reports everything, so the same finding arriving twice must not read as two problems. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a Qualys update is not your on-call problem.
- One integration serves your product and your agents. The same governed Qualys connection powers in-product features and gives AI agents scoped, audited access, so you get security findings in front of the people and systems that act on them without wiring it twice.
Used by these teams
Compare with
Works well with
Nexthink
ServiceNowOften used alongside
Tools the same teams tend to run next to Qualys, across other categories.
Okta
Datadog
Microsoft Entra ID
PagerDutyQualys integration FAQ
How do I add a Qualys integration to my product?
Enable the Qualys connector in your fastn dashboard, then let each customer authenticate their own Qualys account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Qualys client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own Qualys account?
Yes. Every connection is scoped to the individual customer, so each authorises their own Qualys account and only ever sees their own findings, detections and assets. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this Qualys integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent lists the detections open on an asset group and explains which ones are severity-critical.
Who maintains the Qualys integration?
fastn does. When Qualys changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
How does a new Qualys finding reach my product?
Through event triggers rather than polling, delivered per tenant, so your product reacts when a finding is raised or its severity changes rather than on a schedule that is always slightly out of date.
How is Qualys finding noise kept manageable?
Findings are deduplicated per asset so a rescan does not re-raise what you already have, and you can filter by severity and status before anything reaches your product. That matters more here than in most integrations, because the volume is what stops teams acting on any of it.
What can I build with the Qualys integration?
A common starting point: let each customer connect their own Qualys subscription, including the platform their account sits on, so the API host is configuration rather than a constant. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the Qualys integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding Qualys does not change your per-connector cost. You can start free with 3 connected accounts.
Add Qualys to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.