Configure Qualys Portal

Prerequisites 

• To integrate with Qualys FIM, you must first obtain an activation key and configure the rules within the Qualys Portal.

Configure a System as an Asset on the Qualys Portal

To register your machine or system as an asset within the Qualys Portal:

1. Log in to the Qualys Portal.
2. In the upper-left corner, open the Modules drop-down menu, and then click Cloud Agent.
   The Agent Management page appears.
   

   

3. Click the Agents tab. 
4. Click Install New Agent.
   The New Activation Key page appears.
   

   

5. Enter a Title for this activation key, and then click the File Integrity Monitoring checkbox.
   

   

6. Click Generate.
   The activation key appears.

   

   Copy and save this activation key, as you'll need it later on during the installation process.

7. Locate the operating system on which the Qualys agent will be installed in the list, and click Install Instructions.
   

   

8. Copy the text in the box as shown in the screenshot.
   

   

9. Click Download .exe.
   A download initiates.

10. After downloading the .exe file, open Command Prompt on your machine.

    

    To open the command prompt on a Windows machine, click Search on the toolbar and type "run." The Command Prompt will display as the top search result.

11. Paste the text you copied in Step 8 into the Command Prompt and press Enter.
    After a few minutes, your system will be registered as an asset in the Qualys Portal.

12. To verify the asset was successfully added, open the File Integrity Monitoring drop-down menu in the upper-left corner, and click the Assets tab.
    The new asset appears in the list.
    

    

    
    
    

    

Configure an Asset for File Integrity Monitoring

Once you have registered the asset in the Qualys Portal, you can set it up for File Integrity Monitoring (FIM). To enable FIM for a registered asset:

1. Log in to the Qualys Portal.

2. In the upper-left corner, open the Modules drop-down menu, and then click File Integrity Monitoring.

3. Click the Configuration tab.
   

   

4. Click Create New Profile.
   The Create FIM Monitoring Profile page appears.
5. Enter the Profile Name, Operating System, and Category.
   

   

6. Click Next.

7. Click Create New and select Rule.
   The Create New: Monitoring Profile Rule page appears.
   

   

   

   The rule configuration determines the location of directories which are required to be monitored by Qualys FIM.

8. Enter a Rule Name, and click Create Section.
   The Create New: Rule Section page appears.
   

   

9. Enter a Section Name, and click Manage.
   The Category List page appears.
   

   

10. Click Create New Category.
11. Enter a Category Name, and click Close.
12. Click Save.
13. Select the Rule Type from the drop-down menu.
14. Select the Severity from the drop-down menu.
    

    

15. Enter the File Path.
16. (Optional) If File is selected as the Rule Type, select which items the file should be monitored.
    

    

17. (Optional) If Directory is selected as the Rule Type, select the Depth to specify the scan limitations of the Qualys FIM agent.
    

    

18. (Optional) If Directory is selected as the Rule Type, select which items the directory structure and the files within the directory structure should be monitored.
    

    

19. (Optional) Configure the Advanced Options to exclude or include certain files and directories.
    

    

20. Click Save Rule. 
21. To assign assets to the created rule, click the Assign Assets tab.
    

    

22. Click Select Assets.
    The Asset Selector page appears.
    

    

23. Click each asset to which the rule should be assigned.
24. Click Assign Asset.
25. Click Save.
    

    

26. In the Profiles tab, right-click on the newly created profile and click Activate.
    

    

27. Click Yes.
    The asset is successfully configured for File Integrity Monitoring.

View Generated File Integrity Monitoring Logs for the Asset

To view generated logs for an asset:

1. Log in to the Qualys Portal.
2. In the upper-left corner, open the Modules drop-down menu, and then click File Integrity Monitoring. 
   

   

3. Click the Events tab.