Prove Qualys is scanning — first tool + proof field

1. Why “is it scanning?” is five questions

Operators collapse five failures into one sentence. The IP was never added as a host asset. The Cloud Agent never registered. The last VM scan is eighteen days old. The QID is Potential, not Confirmed. The Pune virtual scanner missed four heartbeats. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught TruRisk, last-checkin, and pending reboot as the week’s sentence. Here you learn the five tools you actually open, in order, when someone asks you to prove Qualys is scanning — or to explain why a host is missing.

Hero · five tiles, one missing host

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you launch a second scan of a box that was never in the target list.

3. Decision flow — ticket → first tool

Flowchart first. Do not open New Scan until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Qualys Cloud Platform. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the host and the Cloud Agent. Side B proves the last scan and the VMDR finding. Side C proves the scanner appliance. On a messy Sev-2, do them in this order until a field lights up.

Side A — Host record + Cloud Agent (inventory / check-in)

1. Prove the host exists before you talk about QIDs

   Search AssetView (or CSAM Inventory → Assets) for name, interfaces.address, or netbiosName. Parallel path in VM/VMDR: Assets → Host Assets → Info. Official: View Host Information; Manage Your IPs (Host Assets). If AGMS is on, the tab is Address Management. Quote IP, DNS / NetBIOS, trackingMethod, tags, First Found Date. No row → stop. The IP was never added, was purged, or tracking does not match the name they typed.

2. If they said “we installed the agent,” open Cloud Agent — not VMDR

   Path: Cloud Agent (CA) app → Agents tab. Official: Tell me about Cloud Agent Status; Cloud Agent Status (getting started). After install you should see status within a few minutes. No status means the agent did not connect and register — usually HTTPS 443 to the Cloud Platform URL under Help → About, or a missing proxy.

3. Read Last Checked In, then Status, then ACTIVE / INACTIVE

   Last Activity = provisioning, manifest download, inventory sync. Last Checked In = latest VM / PC scan, manifest download, or other agent activity — officially more recent than Last Activity. Status walk: Provisioned → Manifest / Configuration Downloaded → Inventory Scan Complete → Scan Complete (platform assessed the upload). AssetView agentStatus: ACTIVE = communicated in the last 48 hours; INACTIVE = has not. First Scan Complete can sit for 30 minutes to 2 hours on the baseline upload. That lag is documented. It is not a Sev-1.

4. If the host is missing and there is no agent, check whether anyone added the IP

   Official scanning basics: IPs you can scan live under Assets → Host Assets. If the IP is not listed, add it (or have a Manager add and assign it), then scan. A discovery map finds live devices; it does not invent a host asset for VM until you add it.

Side B — Last scan + VMDR detection (assessment / finding)

1. Quote Last Scan Date, and say which sensor wrote it

   Host Assets → Info → Last Scan Date (VM, and compliance if used). QQL: lastVmScanDate, plus lastVmScanDateAgent vs lastVmScanDateScanner when you must split sensors. Official: View Host Information; AssetView search tokens. If the date is null, CSAM purge rules treat lastVMScanDate IS NULL as “never scanned by VM.”

2. If last night’s scan “ran” but the date did not move, open the scan Appendix

   Path: VM/VMDR Scans → View. Official: Vulnerability Scan Results. Appendix lists hosts not scanned: paused, canceled, excluded (per-scan or global Excluded Hosts), not alive (and Scan Dead Hosts off), hostname not resolved for that tracking method, or scan discontinued. Authentication failures also land in the Appendix — run Reports → New → Authentication Report before you launch another scan.

3. Read the three VMDR columns that close a finding ticket

   VMDR Vulnerabilities. Quote vulnerabilities.status (New / Active / Fixed / Reopened — Fixed list is last 365 days), vulnerabilities.typeDetected (Confirmed / Potential / Information), vulnerabilities.lastFoundDate. Optional siblings: firstFoundDate, qid, detectionSource.name (e.g. QUALYS_AGENT). Confirmed means Qualys verified the condition. Official KB: an authenticated scan or Cloud Agent can still return Potential when the signature cannot prove the patch/workaround. Confirmed is not “already exploited.”

Path:            VMDR → Vulnerabilities
Host:            name:`fin-app-41`   or   asset.name
QID filter:      vulnerabilities.vulnerability.qid:90405
Quote:           status + typeDetected + lastFoundDate
If empty list:   lastVmScanDate / Agents Status / Scans Appendix
If Fixed:        lastFixedDate  (Fixed window = last 365 days)

Side C — Scanner appliance (the sensor that should have hit the VLAN)

1. Open Appliances, not a new option profile

   Path: VM/VMDR Scans → Appliances. Official: Check Your Scanner Status; Scanner Appliance Heartbeat Check Notification. After you add a scanner, refresh — the UI can take a few minutes. Internal IPs need an appliance in the account; External uses Qualys cloud scanners. You will not see the Scanner Appliance option if you have no appliances.

2. Read Connected, then Heartbeat Checks Missed

   The green Connected icon means the appliance is ready to process scans and pull software updates. Platform heartbeat is every 4 hours. Preview pane shows Heartbeat Checks Missed. Official: if you still see Connected, the appliance is ready — a missed check can be stale after it recovered. Capacity starts at 100% until you launch a scan.

3. If Connected is gone, prove reachability before you rewrite the schedule

   Help → About lists Cloud Platform URLs the appliance must reach (management, health checks, scan-data upload — LAN by default). Split WAN is documented when the scan network has no direct Internet. Do not treat a dark appliance as “everyone’s QIDs Fixed together.”

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only (RFC 5737 addresses, example.com names).

QYED-01 — Prove the host (AssetView / Host Assets)

01:42 · P2. Priya: the Finance box is not on the weekly. L1 already queued an unauthenticated scan of 203.0.113.0/24.

First tool: AssetView / CSAM Inventory → Assets, query name:`fin-app-41` or interfaces.address:203.0.113.41. Same fact on VM/VMDR Assets → Host Assets → Info.

If empty: the host is not a scan target. Quote the empty result. Next check is add-IP / assignment / purge / trackingMethod mismatch — not a new option profile. Official: if the IPs you want to scan are not listed, add them.

If present: quote name, IP, trackingMethod, tags, First Found Date. Now you are allowed to ask about Last Scan Date. The host card is not a QID.

QYED-02 — Prove the agent (Cloud Agent status)

02:05 · P2. Imaging dropped the agent at 18:00. VMDR is still empty. Someone wants the installer re-pushed.

First tool: Cloud Agent → Agents. Filter the hostname.

Proof field: no Status → never registered (443 / Help → About URL / proxy). Status = Inventory Scan Complete and Last Checked In is minutes → inventory landed; wait for Scan Complete (documented 30 min–2 h on first baseline). Status = Scan Complete and agentStatus ACTIVE → the agent is talking; empty VMDR is a last-scan or QID question, not an installer question.

QYED-03 — Prove the last scan (Last Scan Date)

02:20 · P2. Host exists. Agent ACTIVE. Last Scan Date is 18 days old. Security thinks Qualys stopped.

First tool: Host Assets → Info, and split lastVmScanDateAgent vs lastVmScanDateScanner.

Proof field: Last Scan Date + which sensor. Then Scans → View for the job that should have included this IP. If the host is in the Appendix as not alive, excluded, or auth-failed, that sentence is the ticket. Remember the official stall: dead-after-alive, or active host with no vulnerabilities, will not move Last Scan Date.

QYED-04 — Prove the detection (VMDR)

02:40 · P2. CISO: “QID 90405 is gone.” The weekly PDF still lists it. L1 wants the QID disabled.

First tool: VMDR → Vulnerabilities. Filter host + vulnerabilities.vulnerability.qid:90405.

Proof field: status + typeDetected + lastFoundDate. Active + Confirmed + lastFound last night → it is not gone. Fixed + lastFixedDate today → the weekly is stale. Potential after an authenticated scan is allowed — official KB: agent/auth does not force Confirmed. Empty row with a fresh lastVmScanDate → the finding is not on this host; do not disable the QID in the KnowledgeBase to clean a PDF.

QYED-05 — Prove the appliance (scanner health)

03:00 · P1. Pune VLAN: every desk missed the 02:00 scan. VMDR for that tag is empty. L1 wants Force-rescan of the subscription.

First tool: Scans → Appliances for the scanner assigned to that asset group / tag set.

Proof field: Connected missing + Heartbeat Checks Missed ≥ 1 at 02:00. Simultaneous VLAN death is almost never “every QID Fixed at once.” Restore 443 to the platform URL, wait for Connected, then re-run the scheduled scan. If Connected is green, open the scan Appendix — excluded hosts and Scan Dead Hosts explain a quiet VLAN without a dark appliance.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Qualys Docs — Search Tokens for IT Assets (AssetView) (name, interfaces.address, trackingMethod, agentStatus, lastCheckedIn, lastVmScanDate, lastVmScanDateAgent, lastVmScanDateScanner)
• Qualys Docs — View Host Information (Assets → Host Assets → Info; Last Scan Date; First Found Date; tracking; official date-stall cases)
• Qualys Docs — Manage Your IPs (Host Assets)
• Qualys Docs — Scanning – The Basics (VM/VMDR) (Host Assets target list; AGMS Address Management; maps vs add-IP; scanner option; Appendix-related scan behaviour)
• Qualys Docs — Tell me about Cloud Agent Status (Last Activity, Last Checked In)
• Qualys Docs — Cloud Agent Status (Provisioned, Manifest Downloaded, Configuration Downloaded, Inventory Scan Complete, Scan Complete)
• Qualys Docs — Cloud Agent Troubleshooting (no status = not registered; 443 / Help → About; first Scan Complete lag)
• Qualys Docs — Tell me about Vulnerability Scan Results (Scans → View; Appendix reasons a host was not scanned; Authentication Report)
• Qualys Docs — Vulnerability Status Levels (New, Active, Fixed, Re-Opened)
• Qualys Docs — Severity Levels (Confirmed vs Potential; auth/agent can still be Potential)
• Qualys Docs — Search Tokens for VMDR (vulnerabilities.status, typeDetected, lastFoundDate, qid, detectionSource.name)
• Qualys Docs — Check Your Scanner Status (VM/VMDR → Scans → Appliances; Connected; capacity)
• Qualys Docs — Scanner Appliance Heartbeat Check Notification (4-hour heartbeat; Heartbeat Checks Missed; Connected = ready)
• Qualys Docs — Create Asset Purge Rules (lastVMScanDate / never scanned by VM)
• Qualys Docs PDF — API (VM, PC) User Guide (scan results XML; cited from scan-results Help)

Related: Blog 1 · Qualys session factory — TruRisk is the first sentence · Qualys VMDR practice hub