How to exclude hosts from scans

Document created by Qualys Documentation Employee on Oct 9, 2012Last modified by Qualys Documentation Employee on Feb 5, 2016
Version 9Show Document
  • View in full screen mode

It's easy to exclude hosts for a specific scan or for all scans within the subscription. No scanning traffic, including ICMP, TCP and UDP probes, will be sent to hosts that are excluded.


Option 1: Exclude hosts per scan

When launching a scan select the IP addresses/ranges you want to exclude from the scan in the Exclude IPs/Ranges field. Use commas to separate multiple entries. Want to exclude hosts for a scan schedule? Use the same Excluded IPs/Ranges field in the schedule wizard.




Option 2: Globally exclude hosts

There is one global excluded hosts list for the subscription. To see this list or to make changes to it, go to Scans > Setup > Excluded Hosts.




The Excluded Hosts Setup page appears with a list of IPs currently excluded, if any. Click Edit to make changes to the list. You can add or remove hosts. Note that add and remove actions must be performed at different times.




In the Hosts section, enter the IPs you want to add to the list.




Now click Comments on the left side and enter notes about the changes you're making. Comments are required and will be saved in the history log for the excluded hosts list. When you're done, click the Add button to add the hosts to the excluded hosts list. (If you're removing IPs from the list click the Remove button instead.)




A confirmation window will appear. Click Add again to confirm the change.





Want to know more?

Which users have privileges to globally exclude hosts?

Managers and Unit Managers have privileges to edit the global excluded hosts list. Managers can add/remove any host. Unit Managers can add/remove any host in their business unit.


Can I add IPs to the excluded hosts list that aren't in my subscription?

Yes. IPs not currently in the subscription may be added to the excluded hosts list. This ensures that they will not be scanned even if later added to the subscription.


Is it possible for an excluded host to show up in map results?

Excluded hosts may appear in map results if discovered via a DNS method. If the IP belonging to a DNS server is included in the excluded hosts list and this server is used to resolve DNS names for hosts in the map target, then the service will still send normal requests to the DNS server. The server, however, will not be scanned for vulnerabilities.