How do I search my assets for a specific web server running IIS?
To get a list of the hosts that have IIS running, do the following:
1. Login to your QualysGuard account, select VM, and go to Assets > Asset Search under Navigation.
2. Set the Asset Group to All.
3. Click the checkbox next to QID and enter 86000 and then change the With Results section to "containing" and then enter IIS in the blank field.
4. You can refine the search to different versions of IIS by changing the "results" string to IIS/4 for IIS version 4, or IIS/5 or IIS/6 or IIS/7 for the different versions. (This information was obtained by first doing a query for IIS and then looking at how the results are displayed.)
After you have setup your search criteria, click Search at the bottom. When the new window opens you should have a list of all of the hosts that meet the following criteria:
1. They are registered as host assets in your account.
2. They have been scanned at least one time and QID 86000 (Web Server Version) has been detected.
3. The results of this QID contains the phrase IIS (/4 /5, etc).
When you are viewing the search results you can also select all of the hosts and choose "Add to new Asset Group" from the pull-down menu at the top. This will let you store these results so that you can re-scan or at least re-identify them in the future if needed.
Qualys Support KnowledgeBase