{
  "name": "QualysVMLogsCCPDefinition",
  "apiVersion": "2025-03-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "QualysVMLogsCCPDefinition",
      "title": "Qualys Vulnerability Management (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Qualys Vulnerability Management (VM)](https://www.qualys.com/apps/vulnerability-management/) data connector provides the capability to ingest vulnerability host detection data into Microsoft Sentinel through the Qualys API. The connector provides visibility into host detection data from vulerability scans.",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "Qualys Host Detection Logs",
          "baseQuery": "QualysHostDetectionV3_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of Qualys Host Detection logs",
          "query": "QualysHostDetectionV3_CL\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "QualysHostDetectionV3_CL",
          "lastDataReceivedQuery": "QualysHostDetectionV3_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "API access and roles",
            "description": "Ensure the Qualys VM user has a role of Reader or higher. If the role is Reader, ensure that API access is enabled for the account. Auditor role is not supported to access the API. For more details, refer to the Qualys VM [Host Detection API](https://docs.qualys.com/en/vm/qweb-all-api/mergedProjects/qapi-assets/host_lists/host_detection.htm#v_5_0) and [User role Comparison](https://docs.qualys.com/en/vm/latest/user_accounts/user_roles_comparison_vm.htm) document."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Qualys Vulnerability Management to Microsoft Sentinel",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": ">**NOTE:** **QualysHostDetectionV3_CL** stores raw host snapshots and can contain repeated unchanged detections. Use the **QualysHostDetection** parser for detection-level records. The parser expands **DetectionList**, removes repeated unchanged versions, and preserves status, timestamp, and relevant content changes."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "To gather data from Qualys VM, you need to provide the following resources"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. API Credentials \n To gather data from Qualys VM, you'll need Qualys API credentials, including your Username and Password."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. API Server URL \n To gather data from Qualys VM, you'll need the Qualys API server URL specific to your region. You can find the exact API server URL for your region [here](https://www.qualys.com/platform-identification/#api-urls)"
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Qualys API User Name",
                "placeholder": "Enter UserName",
                "type": "text",
                "name": "username",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Qualys API Password",
                "placeholder": "Enter password",
                "type": "password",
                "name": "password",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "Qualys API Server URL",
                "placeholder": "e.g. https://qualysapi.qg1.apps.qualys.com",
                "type": "text",
                "name": "apiServerUrl",
                "description": "Enter the Qualys API Server base URL. Format: https://<your-qualys-api-host> (e.g. https://qualysapi.qg1.apps.qualys.com). Do not include the API version path or a trailing slash. Find your regional API URL at https://www.qualys.com/platform-identification/#api-urls",
                "validations": {
                  "required": true
                }
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 3. Truncation Limit \n Configure the maximum number of host detection records to retrieve per API call. **Recommended: 1000 (Qualys default).** Lower values reduce response size and are safer for large environments or slow API servers but require more paginated calls. Higher values increase response size and risk API timeouts, especially on large environments. Values below 500 may cause excessive pagination that exceeds processing limits on large deployments."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**Timeout limit:** The maximum allowed API timeout is **5 minutes (300 seconds)**. This is the platform maximum and cannot be raised. For large environments, lower the **Truncation Limit** to keep each API response within this limit."
              }
            },
            {
              "type": "Dropdown",
              "parameters": {
                "label": "Truncation Limit",
                "name": "truncationLimit",
                "options": [
                  {
                    "key": "1000",
                    "text": "1000 - Recommended default (Qualys default, best balance)"
                  },
                  {
                    "key": "20",
                    "text": "20 - Not recommended for large environments (risk of pagination timeout)"
                  },
                  {
                    "key": "100",
                    "text": "100 - Small environments only"
                  },
                  {
                    "key": "500",
                    "text": "500 - Suitable for medium to large environments"
                  },
                  {
                    "key": "2500",
                    "text": "2500 - Risk of API timeout on large or slow environments"
                  },
                  {
                    "key": "5000",
                    "text": "5000 - Not recommended (high risk of API timeout)"
                  }
                ],
                "placeholder": "Select truncation limit",
                "isMultiSelect": false,
                "required": true
              }
            },
            {
              "type": "Dropdown",
              "parameters": {
                "label": " Show QDS Value",
                "name": "show_qds",
                "options": [
                  {
                    "key": "0",
                    "text": "False (default)"
                  },
                  {
                    "key": "1",
                    "text": "True"
                  }
                ],
                "placeholder": "Select QDS value",
                "isMultiSelect": false,
                "required": true
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "toggle"
              }
            }
          ]
        }
      ]
    }
  }
}