> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-vulnerability-prioritization/qualys-vmdr-setup-for-workbench.md). # Qualys VMDR Setup for Workbench Integrating your Qualys VMDR scanner technology with Workbench allows Expel to aggregate and evaluate Qualys VM findings across your entire environment into cohesive Expel recommendations. The integration also enriches the VM findings with exploit information and vulnerability context, and prioritizes individual vulnerability findings. ## Prerequisites 1. You must have access to the VMDR console with **Admin rights**, as you need to be able to create new users within the console. 2. You must be able to manage a **new API user** and assign it to a Role within VMDR that has the following permissions enabled: * API access * Asset Management module access * Vulnerability Management module access 3. You must be able to assign the **Expel console user** to a Role within VMDR that has the following permissions enabled: * UI access * Asset Management module access * Vulnerability Management module access ## Step 1: Create a New API User in VMDR You must create a new API user in the VMDR console that also has the appropriate module permissions. The purpose of this user is to generate API credentials that Expel can leverage to connect to Qualys. This user will be managed by you and should include your email (or you may use a group email address if this is within your company policy); this allows you full control of the API credentials and any necessary resets. 1. [Log in to Qualys](https://qualysguard.qg1.apps.qualys.ca/qglogin/index.html). 2. From the Dashboard, select the **Users** tab. 3. Above the list of users, select **New**. 4. Create a new console user, entering the following values for these attributes: * **Name** - enter "Expel API Key". * **Email** - enter your email address (you will manage this user). * **Role** - You must assign this user to a Role that has permission to access the application via the API, and that also has access to both the Asset Management and Vulnerability Management modules. {% hint style="info" %} The chosen Role may be an "Admin" role or a lesser role that has these three permissions enabled. {% endhint %} 5. **Save** the new user. ## Step 2: Create an Expel Console User in VMDR You must also create a new user for Expel that has the appropriate UI and module permissions. The purpose of this user is to allow Expel to log in to the VMDR web console. 1. Still in the Qualys Dashboard on the Users tab, select **New**. 2. Create a new console user for Expel, entering the following values for these attributes:: * **Name** - enter "SOC & Expel". * **Email** - enter "". * **Role** - You must assign this user to a Role that has permission to access the application via the API, and that also has access to both the Asset Management and Vulnerability Management modules. * **Phone** - enter "1-844-397-5762". {% hint style="info" %} The chosen Role may be an "Admin" role or a lesser role that has these three permissions enabled. {% endhint %} 3. **Save** the new user. An email will be generated that will allow Expel to activate the account and set a password. {% hint style="warning" %} **Before you continue to the next step:** Wait to hear back from Expel to confirm the Qualys login information (username and password) for this new user, as you will need it to set up the security device. Credentials will be sent to you via 1Password within 72 hours. {% endhint %} ## Step 3: Add Qualys as a Security Device in Workbench Before you begin, make sure you have received Expel's Qualys login credentials via 1Password. You will need these credentials to configure the security device. 1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). 2. In the side menu, navigate to **Organization Settings > Security Devices**. 3. Select **Add Security Device**. 4. In the search box, enter “Qualys” and then select the Qualys integration. 5. Complete the fields as follows: * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Qualys”; this name will display in Workbench under the Name column, and is a text string that you can filter on. * **Location** - enter the location of your integration, for example “cloud;” this is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations. * **Qualys platform API server URL** - go to the [Qualys Platform Identification](https://www.qualys.com/platform-identification/) page to find your **API Server URL**, then enter it here. * **Username** - enter the username for the **API user**. * **Password** - enter the password for the **API user**. 6. Select **Save**. 7. Select **Set up now** and then select **Save** to continue setting up your console access. * **Console URL** - go to the [Qualys Platform Identification](https://www.qualys.com/platform-identification/) page to find your **Platform URL**, then enter it here. * **Username** - enter the username for the **Expel console user**. * **Password** - enter the password for the **Expel console user**. * **Two-factor secret key** - optional; if one is needed as part of the web console login process, enter it here. 8. Select **Save**. Your device should be created successfully within a few seconds. A few reminders: * After your connection is healthy, it will take some time for your device to begin polling and receiving data. * To check on the status, select the downward arrow for your device in the first column and choose **View details**. * Polling will happen first; data will be received after that. **You must refresh the page to see updates.** * If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md). * To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/more-features/expel-vulnerability-prioritization/qualys-vmdr-setup-for-workbench.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.