Qualys VMDR

The Qualys VMDR parser for DefectDojo supports imports from CSV format. This parser handles both QID-centric and CVE-centric export variants from Qualys VMDR (Vulnerability Management, Detection, and Response).

Supported File Types#

The Qualys VMDR parser accepts CSV file format in two variants:

QID Format: Primary vulnerability identifier is the Qualys QID CVE Format: Includes CVE identifiers and CVSS scores from NVD

To generate these files from Qualys VMDR:

1. Log into your Qualys VMDR console
2. Navigate to Vulnerabilities > Vulnerability Management
3. Select the assets or vulnerabilities to export
4. Click “Download” and select CSV format
5. Choose either QID-centric or CVE-centric export option
6. Upload the downloaded CSV file to DefectDojo

Default Deduplication#

The parser uses DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE, which tries unique_id_from_tool (populated with the Qualys QID) first and falls back to hashcode deduplication.

Hashcode fields: title, component_name, vuln_id_from_tool

For more information, see About Deduplication.

Sample Scan Data#

Sample Qualys VMDR scans can be found in the sample scan data folder.

Link To Tool#

• Qualys VMDR
• Qualys Documentation

QID Format (Primary Export)#

QID Format Field Mapping#

Additional Finding Settings (QID Format)#

CVE Format (Extended Export)#

CVE Format Field Mapping#

Additional Finding Settings (CVE Format)#

Special Processing Notes#

Severity Conversion#

Qualys severity levels (1-5 numeric scale) are converted to DefectDojo severity levels:

• 1 → Info
• 2 → Low
• 3 → Medium
• 4 → High
• 5 → Critical

The original Qualys severity is preserved in the severity_justification field as “Qualys Severity: X”.

Endpoint Handling#

The parser creates Endpoint objects from IP addresses:

• Multiple IPv4 addresses (comma-separated) create multiple endpoints
• Falls back to IPv6 if no IPv4 address is present

CSV Format Handling#

Qualys VMDR exports use a non-standard CSV format where each row is wrapped in outer quotes and fields are delimited by ,"" instead of standard ",". The parser automatically detects and handles both standard and non-standard CSV formats.

Multi-line records: Qualys fields such as Results and Threat may contain embedded newlines. The parser correctly assembles multi-line records that span multiple lines in the CSV file, including records containing malformed quote patterns in fields like Results.

Metadata lines: Some Qualys exports include 3 metadata lines (report title, date range, column count) before the header row. The parser auto-detects whether metadata is present and skips it accordingly.

Data Cleaning#

• HTML tags in fields like Threat (mapped to impact) are stripped automatically
• Qualys null markers ('-) are filtered and treated as empty values
• Stray quotes left by the non-standard CSV format are cleaned from field values

Format Detection#

The parser automatically detects whether the import file is QID format or CVE format by examining the first column of the header row:

• If first column is “QID” → QID format parser is used
• If first column is “CVE” → CVE format parser is used