Can we use the virtual scanner appliances to scan internet connected Hosts using cloud Agent?
Our plan is to:
Install the virtual Scanner appliance on one network with 2 NICs
Install Cloud Agents on another network
Connect the virtual scanner to scan the hosts in another network using CAs
Thanks for your suggestion, David. We are trying to avoid the virtual scanner for VM as we need to deploy and maintain it. As we are using cloud Agents, can we deploy and configure them using an external scanner from Qualys directly?
Our Technical manager suggested us to go with virtual appliance than an external scanner but we would like to look into possibilities for deployment.
Manoj, in addition to what David suggested, if you're just starting out with configuring your scanners, I recommend having a discussion with your TAM. He'll able to suggest where to place your scanners so you get the best results. He'll also give you suggestions on reporting best practices.
Let us know if we can help further.
Thank a lot Shyam, our TAM has notified us that the CAs need a scanner appliance for the VM scanning to work and suggested us to go with scanner appliance. However; we believe that this can also be achieved from the Cloud platform using an external scanner from Qualys.
Please correct me if I am wrong.
Cloud Agents can work standalone. They gather inventory and vulnerability data and send them to the Qualys platform.
However, if you'd like to scan devices such as firewalls, printers, etc. you'll have to use the scanner appliance. This is because the agent cannot be deployed on such devices.
I believe this is why your TAM has rightly suggested using both Cloud Agent and scanner appliances.
Manoj,
I concur with Shyam. When you install the Cloud Agent you can optionally activate one or more Modules such as Vulnerability Management or PC (Policy Compliance) on an individual agent or a LOT of Agent. When Agents when installed will call into the Qualys SOC (64.39.96.0/20) in general on TCP:443 (HTTPS). The Agents gather all the information on the local host that they have been told to gather. What they are "told to gather" is determined by the modules you have activated.
Once the data is gathered the data is uploaded to the Qualys SOC for your account. That data is then correlated in the Qualys cloud; so from a Qualys perspective the Agent does not scan for anything; it just collects a LOT of data.
Once correlated with Vulnerability Information or Policy data etc... you can generate reports, and dashboards. So hosts with the Cloud Agent should not need to be scanned by the Qualys service external or otherwise. Now the Cloud Agent does not do everything. If your trying to assess a Web Application then you would need a scanner for that.
Does that help clear up a couple of things?
To be clear, not all vulnerabilities in the KnowledgeBase are detectable by the Cloud Agent. For this reason, external facing assets running the Cloud Agent should also be scanned with an appliance, and I strongly recommend doing external scans from the Qualys SOC and not from your internal appliance. Scanning externally from your internal appliance means you will be traversing firewalls and proxies which can cause performance issues, etc..
Currently, the KB holds 37,662 detections. Of those, 27,928 can be detected by CA. To find which detections are supported by an agent, you'll want to search the KB with the following selections:
You may want to consider performing routine scans for only those detections the CA cannot detected by doing the following:
Create a search list (perhaps CA-Detections) with the same search criteria as seen in the image above.
Then create a scan option profile, that looks like this:
This way your appliance based scans won't be checking what the CA is already checking and your scans will run efficiently and quickly.
Thanks Debra,
First, we are NOT scanning routers and firewalls but only the Hosts. As per the responses above, we DO NOT need a virtual scanner appliance but just:
Cloud Agents with VM enabled
shyam_raj and Busby please acknowledge.
We are really unsure as to why our TAM is unable to know this and asked us to use the Virtual scanner. Thanks a lot Guys..!!!
You were really helpful ..!!!
Manoj,
First let me state, I do not work for Qualys.
That being said your TAM would be or should be more familiar with the issues your trying to solve. If you just doing a Vulnerability Assessment from an OS Vulnerability standpoint and all of your HOSTS are outside of any perimeter firewall then you could use external scanners. If you have an internal network then you could either allow the Qualys SOC to come into your internal network or deploy a virtual scanner to scan those hosts internally.
But as Debra stated If you have the Cloud Agent installed with VM running then as long as the agent can reach the SOC that part is good. It is just if you wish to also scan the hosts.
I don't know enough about your network topology to make a more educated recommendation.
Sorry I can't give more definitive help.
Technically yes. if your internal appliance can reach an external IP then you could scan the hosts. However; if you have the Cloud Agents running on the hosts then you probably don't need to scan them for vulnerabilities just make sure you have the vulnerability module turned on in your Agents.
Then you could be scheduling regular reports or create an AssetView Dashboard etc..
You would not need to be scanning if the Agent has the VM Module active and they are communicating.
Please let me know if I can assist you in anyway.
David