Qualys Cloud Platform Erfahrungen

The Console . The Qualys console has all the modules like VMDR , PC, SCA, PM , FIM etc. The Same agent can be used to perform all these tasks and scan for vulnerabilities . Its pretty straightforward and easy.

Reporting format is a bit shaggy if you would ask me ..But having said that , the addition and deletion of controls also has to be more easily doable.

this product really does allow you to see how secure your assets are. It also has a patch management feature. Great training videos and community

sometimes the new features can cause confusion. This is normally due to consolidation

From my years of experience with vulnerability management solutions, Qualys is the best one in the market. First, it is really easy to set up, specially the cloud solution. In less than few hours you can start scanning your environment. Second, it's vulnerability database is constantly updated with the latest vulnerabilities. Third, it contains tons of apps that extends its capabilities (e.g. Asset management app, web application scanning, PCI compliance monitoring, etc.) ...

The price tag is not the cheapest one. Their licensing model is per IP on the scope, not per live IPs. So for example, if you have three /24 networks with one server each, you will be paying to scan 765 IPs (255*3) instead of only 3 IPs.

The Qualys product has been on the market for a long time. It's used by many people and you know you can trust it.

The new and the old UI are run in parallel, and sometimes, you're swapped between them. This can be a bit confusing.

I love the ease of use especially when you're managing multiple sites. The Qualys dashboard has to be the best hands down

It gets a bit complicated when it comes to the set up and deployment. And another thing was the delay in endpoint scanning, it takes a while for the update information from the endpoints

Comprehensive security coverage, scalability, and ease of use

Cost can be subjective depending upon the org size. Also configurations are to be done very accurately for getting desired results.

Qualys is easily the best VM tool available because of many features like easy deployment, good UI, great customer support and outstanding VM features especially scanning, asset management, reporting etc. Container security and policy compliance modules work like a charm.

There is no offline deployment in qualys, so for air gapped environments Qualys cannot be used.

Reporting features, wide product catalog KB

Overall price, difficult to setup with client installation

True Positive Report for Vulnerability and VMDR is amazing really happy to use

Sometime it take like 24 hours for agent to get reflect in the portal

This product has high quality vulnerability scanner , supper easy to setup and implement in enterprise environment. Saves endpoint from any ransomeware , hack and vulnerabilities by patching them at the right time . Vast database of vulnerability detection and fixing .Reporting & dashboard are of highly professional quality. Its now supper impressive to showcase these reports to management.

Nothing specific found till date.

Facilité de création de rapport, scheduler des analyses, filtre très fins

rien à signaler sur cette solution d'analyse de vulnérabilité

Full fledged VAGreat suiteFlexible deployment optionsFree updates

Integration between modulesWeak patch management integration

Easy to implement, enabling sensors are not much techie.

Sometime handling false positive detection are really a tough task.

Qualysguard performs scan based on IP addresses rather than URL’s.

It easily accessible from anywhere as its as cloud based scanner.

Qualysguard supports scheduling of the scan for target system based on particular time and date and it also acknowledges and share the mail once the scan is completed.

It can also perform the scan and give vulnerabilities as per compliance standards such as PCI DSS.

Qualysguard doesn’t support scan for URL’s as we only need to provide IP address of the URL to perform the scan.

This tool might be costly for small scale organizations.

Qualys gives high-quality reports in an easy to read format. The agent has been easy to install and has not caused any issues.

We have had some instances where scan attempts ended up causing confusion or application outages when they were not designed to handle the scans.

It can scan the systems based on various unique standards like PCI DSS which other scanners by competitors doesn't have .
We can define various scanning profiles for doing vulnerability scans .
It supports scan based on IP rather than URL.
As it is a cloud based scanner it can be accessed from anywhere.
I like the feature that it has option to schedule scans in future.

It can't perform credentialed based scans for external or public facing IP’s
Does Not support URL based vulnerability scans for application.

Nothing - I hate it.

Their ridiculous false positives - apparently it's a critical incompliance that certain options aren't set in the gdm config file /etc/gdm.conf.
Fair enough - if gdm was installed. A simple check that the file exists first would eliminate this and (of our 80+ compliance errors) most others. Complaining about mount options on non-existent filesystems, or that /etc/gshadow didn't match a regex - or did, I'm not sure from the report. The file has mode 0000 (so no permissions set at all).
The fix was to chown root:root /etc/gshadow*

Trust these amateurs at your own risk. If they are as incompetent as this, what are they missing?

The solution is very detailed in what information it collects. The Cloud agent runs as a service on the endpoints and references back to the cloud periodically (the interval is customizable). The GUI is very nice and they are updating things constantly. It is easy to see our Security stance from the different modules.

There is no MSI file to deploy the software via GPO! Also, for me, the assetview module shows a different number of assets than the VMDR asset tab. Why there is a difference, I don't know.

The platform provides pretty up to date scanning capabilities. Reporting contains direct links to available exploits.

Very out dated user interface. Reporting modules have to be purchase separately along with actual scanners

Detailed explanations and possible resolutions for vulnerabilities that are detected by the Cloud Agents.

I have used other solutions as well on the same machines and they seem to detect quite a few different vulnerabilities, it seems neither give a rather complete list, so it's a good idea to use multiple solutions from different vendors with a different focus to get a clear insight in the ones that are classified as higher risks.