Qualys VM / VMDR · CSV or XML export
Qualys report generator: from Qualys export to client report
Upload a Qualys scan or VMDR export and Varaxon Scan Hub turns it into a report your client can read: findings ranked by real-world exploitation, a plain-language fix plan, and every line traced back to the QID that produced it.
What Scan Hub reads from Qualys
Six Qualys layouts.
Raw scan results (CSV or XML), the scan report CSV, the VMDR CVE and QID data lists (CSV) and the asset data report (XML). Scan Hub recognises the layout from the file's contents, not its name.
QIDs and CVEs, as stated.
Each finding keeps its Qualys QID and title. CVEs come only from the CVE column or element, never guessed from a title or vendor reference.
Host, port and SSL context.
Findings stay attached to the device, port, protocol and SSL flag Qualys recorded, so the same QID on two services stays two findings.
How to export from Qualys
- In Qualys VM or VMDR, open the finished scan and download the results as CSV or XML, or run a scan report and download it as CSV.
- From VMDR you can also export the vulnerability data list (by CVE or by QID) as CSV.
- Run the free pre-flight check to confirm Scan Hub can read the file. It stores nothing and needs no account.
- Upload the file to a client in Scan Hub and build the report.
What the report states explicitly
- Confirmed (Vuln) and potential (Practice) findings are counted separately. A potential finding is never presented as confirmed.
- Findings Qualys marks Fixed, or Ignored or Disabled in VMDR, are listed beside the open ones instead of silently dropped.
- Where a finding has no CVE, the report says the CVE set is unknown rather than implying there is none.
Common questions
- Which Qualys exports does Scan Hub read?
- Raw scan results as CSV or XML, the scan report CSV, the VMDR CVE and QID data lists as CSV, and the asset data report as XML. Patch reports, web application (WAS) scans and PCI exports are not read.
- Does Scan Hub replace Qualys?
- No. Keep scanning with Qualys. Scan Hub reads the export and writes the client report, ranked by CISA KEV, EPSS and CVSS.
- How are Qualys severities used?
- Qualys severity is kept as Qualys stated it. Scan Hub's own priority puts known exploited vulnerabilities (CISA KEV) first, then uses EPSS and CVSS to order the rest.
Guide
Turn a scan export into a client reportThe steps from a raw export to a report a client signs off on.Read the guide