Qualys Reporting,
Every QID, Triaged
Import a Qualys VMDR scan report and every QID lands in your engagement as a scan issue, with hosts and result evidence attached. Qualys report import for pentests.
Import Once. Report From One Place.
Qualys VMDR is built to track vulnerabilities across an estate for months. A pentest needs a short list of confirmed issues, written up for one client, by the end of the week. Neuron bridges the two by importing the Qualys report straight into the engagement.
The import joins every host detection to its QID definition in the report glossary, so each issue arrives with the Qualys title, category, severity, threat, impact, solution, CVEs, and vendor references, and every affected host and port carries the result text Qualys recorded for it.
Hosts are created from each IP, DNS or NetBIOS name, and operating system in the report, and ports from every detection that names one. Upload it in the browser, or pipe it from the Qualys API into neuron import.
$ curl -s -u acme_ab12 \ -H "X-Requested-With: curl" \ "$QUALYS_API/fo/report/?action=fetch&id=8812044" \ | neuron import - Importing into Acme External Q4 qualys: 96 hosts, 412 detections✓ 158 scan issues queued for triage- 15:20 Finding TLSv1.0 Supported (22 hosts)
- 15:02 Import Qualys: 96 hosts, 158 scan issues
- 15:01 Command curl ... fo/report | neuron import -
- 14:40 Import Nessus: 91 hosts, 203 scan issues
Why Qualys Reporting Takes So Long
Qualys reports are written for remediation owners, not pentest clients. A single QID can appear on hundreds of hosts, the threat and solution text arrives wrapped in HTML, and the per-host result that proves an issue sits in a different part of the XML from the definition that explains it.
Most teams flatten it to CSV, lose the evidence on the way, and rebuild each finding in a document by copying the QID title, retyping the host list, and pasting whatever result text survived.
Information-gathered QIDs, potential vulnerabilities, and PCI flags all need a decision, and a spreadsheet is a poor place to make one and an even worse place to record it.
Everything Qualys Produces, On the Engagement
Import Qualys output from the browser or with neuron import, and it lands the moment the import finishes.
Hosts and Ports
Every host in the report with IP, DNS or NetBIOS name, and operating system, plus a port record for each detection that names one.
One Issue per QID
Each QID as a single scan issue with its Qualys title, category, threat, impact, and solution, and severity mapped from the Qualys 1 to 5 scale.
Per-Host Results
The result text Qualys recorded for each detection, kept against the host and port it belongs to as proof.
Qualys Context
Detection type, vulnerability status, PCI flag, service, and SSL, shown in the scanner details on every issue.
CVEs and References
CVE IDs from the glossary plus Bugtraq and vendor reference URLs, so a library entry keyed on a CVE matches the QID automatically.
Import Controls
Minimum Severity, an option to include information-gathered QIDs, and a switch to skip host and port creation when the inventory already exists.
How to Import Qualys Results
- 01
Generate the scan report as XML
In Qualys VMDR, open Reports and generate a scan report in XML format. That XML is the ASSET_DATA_REPORT the importer reads. Raw scan result downloads and Qualys WAS reports use different formats and are not supported.
- 02
Import it in the browser
In the engagement, choose Import, then Qualys. Set Minimum Severity, decide whether to include information-gathered QIDs, and switch off host and port creation if the inventory is already built.
- 03
Or pipe it from the Qualys API
Fetch the finished report with the Qualys API and pipe it straight into neuron import. The format is recognised from the content, so no --source is needed.
$ curl -s -u acme_ab12 -H "X-Requested-With: curl" "$QUALYS_API/fo/report/?action=fetch&id=8812044" | neuron import - - 04
Triage and promote
Work the Scan Issues queue by severity or service, mark potential vulnerabilities Confirmed or False Positive after checking them, and promote what is real into findings.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import Qualys results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From Qualysto the Final Report
Each promoted QID reaches the report with only the hosts still marked affected and the result text that proves it, written in your Findings Library's language rather than the Qualys glossary's.
Because issues carry their CVEs, a Qualys QID and a Nessus plugin for the same vulnerability match the same library entry and can link to one finding. The client sees one vulnerability, not two scanners' opinions of it.
When the client remediates and you rescan, import the new report. Detections that disappeared are marked Fixed, open ones update in place, and your triage decisions carry over. A wrong file is one Rollback Import away from gone.
Qualys Integration FAQ
The questions teams ask most about Qualys and Neuron.
How do I import a Qualys report into a pentest report?
Generate a Qualys VMDR scan report in XML format, then import it into the Neuron engagement in the browser or with neuron import. Each QID becomes a scan issue with its affected hosts and result evidence, ready to confirm and promote into a finding.
Which Qualys export format does Neuron accept?
The ASSET_DATA_REPORT XML that Qualys VMDR scan reports produce. Raw Qualys scan result exports (the SCAN format) and Qualys WAS reports are rejected with a clear message instead of being half-imported.
Can I export Qualys VMDR results to a pentest report?
Yes. Import the Qualys XML report into Neuron, confirm the QIDs that matter in the Scan Issues queue, and promote them. Each finding arrives with its hosts, result evidence, and CVEs attached, ready for QA and delivery.
Are information-gathered QIDs imported?
Only if you choose to. Information-gathered QIDs describe hosts and services rather than vulnerabilities, so the Qualys import leaves them out of the triage queue by default and still uses them to build the hosts and ports.
How are Qualys severity levels mapped?
Qualys rates QIDs from 1 to 5. Neuron maps 5 to Critical, 4 to High, 3 to Medium, 2 to Low, and 1 to Informational, so Qualys issues sort alongside every other scanner in the queue. Minimum Severity starts at Low.
Can I pull a Qualys report from the API instead of downloading it?
Yes. Fetch it with the Qualys API and pipe the output into neuron import -. The Neuron CLI recognises the Qualys report from its content and sends it to the right importer.
More Neuron Integrations
Nessus Reporting and .nessus File Import
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryOpenAPI and Swagger Import for API Pentests
Web TestingNikto Reporting and Output Import
Web TestingAcunetix Report Import for Pentest Reports
Web TestingReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform