qualys_vmdr: make QDS parameter opt-out by igcybers · Pull Request #20438 · elastic/integrations

igcybers · 2026-07-31T20:18:50Z

Type of change: bug

Proposed commit message

qualys_vmdr: make QDS parameter opt-out

asset_host_detection hardcoded show_qds=1 and show_qds_factors=1 on every Host List Detection request. Qualys rejects both parameters with error 1901 ("Unrecognized parameter(s)") when they are not available to the subscription or API user.

Add a show_qds variable (bool, default true) and send the two parameters only when it is enabled omitting them entirely,
Defaulting to true keeps existing policies behaving exactly as 6.19.1.

Qualys doc: https://docs.qualys.com/en/vm/qweb-all-api/appendix/appendix_d.htm

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

show_qds defaults to true, so existing policies keep sending both
parameters and QDS field population is unchanged on upgrade.
When disabled, the parameters are omitted from the query string entirely
rather than sent as 0 — Qualys does not accept them at any value on an
affected subscription.

How to test this PR locally

cd packages/qualys_vmdr
elastic-package check -v

Related issues

N/A

Screenshots

Error observed on Qualys API:

<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2026-07-30T12:27:56Z</DATETIME>
    <CODE>1901</CODE>
    <TEXT>Unrecognized parameter(s): show_qds, show_qds_factors (action=list allows: echo_request, ips, ids, id_min, id_max, ag_ids, ag_titles, os_pattern, truncation_limit, network_ids, show_tags, show_asset_id, show_results, use_tags, no_vm_scan_since, vm_scan_since, vm_processed_after, vm_processed_before, vm_scan_date_before, vm_scan_date_after, vm_auth_scan_date_before, vm_auth_scan_date_after, include_ignored, include_disabled, show_host_services, qids, show_igs, show_reopened_info, host_metadata, host_metadata_fields, show_cloud_tags, cloud_tag_fields, severities, include_search_list_titles, exclude_search_list_titles, include_search_list_ids, exclude_search_list_ids, output_format, max_days_since_last_vm_scan, max_days_since_detection_updated, detection_last_tested_since_days, detection_last_tested_before_days, status, include_vuln_type, active_kernels_only, arf_kernel_filter, arf_service_filter, arf_config_filter, suppress_duplicated_data_from_csv, detection_updated_since, detection_updated_before, detection_processed_after, detection_processed_before, detection_last_tested_since, detection_last_tested_before, filter_superseded_qids, arf_filter_keys, show_arf_data)</TEXT>
  </RESPONSE>
</SIMPLE_RETURN>

cla-checker-service · 2026-07-31T20:18:55Z

💚 CLA has been signed

elastic-vault-github-plugin-prod · 2026-07-31T20:19:07Z

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

/test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

asset_host_detection hardcoded show_qds=1 and show_qds_factors=1 on every Host List Detection request. Qualys rejects both parameters with error 1901 ("Unrecognized parameter(s)") when they are not available to the subscription or API user, failing the whole request rather than degrading, so no detections are ingested. Neither parameter appears in the allowed-parameter list returned with the 1901 response, so they must be omitted entirely - sending show_qds=0 fails the same way. Add a show_qds variable (bool, default true) and include both parameters only when it is enabled. Defaulting to true keeps existing policies behaving exactly as 6.19.1. The ingest pipeline already null-guards vulnerability.QDS and vulnerability.QDS_FACTORS, so no pipeline changes are needed when absent. Qualys doc: https://docs.qualys.com/en/vm/qweb-all-api/appendix/appendix_d.htm

igcybers · 2026-07-31T20:24:57Z

/test

The asset_host_detection system tests only exercised requests that carry show_qds=1 and show_qds_factors=1 - every rule in the mock service config matches on both - so the disabled path added in 6.19.2 had no coverage. Add test-ahd-no-qds-config.yml (show_qds: false, ids=9, hit_count: 2) and a matching mock rule whose query params omit both parameters, returning a host whose detections have no QDS or QDS_FACTORS elements. This reproduces the request shape that an affected subscription rejects with error 1901. The rule is keyed on ids=9 so it cannot be confused with the existing ids=1,2,3 and id_min=77777777 rules, and its detections use QIDs 102 and 103 so the existing knowledge base rule for ids=102,103 serves the follow-up request without new fixtures.

efd6 · 2026-08-04T00:34:14Z

+            }).with(
+              // Qualys rejects show_qds and show_qds_factors with error 1901
+              // when they are not available in the subscription,
+              // so they must be omitted entirely rather than sent as 0.
+              state.?show_qds.orValue(true) ?
+                {
+                  "show_qds": ["1"],
+                  "show_qds_factors": ["1"],
+                }
+              :
+                {}
+            ).format_query()


Instead of doing this, set them in the object with:

?"show_qds": state.show_qds ? optional.of(["1"]) : optional.none(), ?"show_qds": state.show_qds ? optional.of(["1"]) : optional.none(),

Note that you do not need to use optional type access for state.show_qds since it's always set by the config, and making it optional would allow a regression to silently change the behaviour rather than crash.

Thank you. Done in: c2ffacd

efd6 · 2026-08-04T22:23:25Z

/test

elastic-vault-github-plugin-prod · 2026-08-04T22:27:41Z

✅ All changelog entries have the correct PR link.

infra-vault-gh-plugin-prod · 2026-08-04T22:52:42Z

💚 Build Succeeded

Buildkite Build
Commit: d989230

mergify · 2026-08-04T23:11:55Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

elastic-vault-github-plugin-prod · 2026-08-04T23:28:37Z

Package qualys_vmdr - 6.19.3 containing this change is available at https://epr.elastic.co/package/qualys_vmdr/6.19.3/

igcybers force-pushed the qualys_vmdr-show-qds-opt-in branch from c386665 to 6cb3fb8 Compare July 31, 2026 20:20

igcybers force-pushed the qualys_vmdr-show-qds-opt-in branch from 6cb3fb8 to c93d678 Compare July 31, 2026 20:24

igcybers marked this pull request as ready for review July 31, 2026 20:24

igcybers requested review from a team as code owners July 31, 2026 20:24

efd6 reviewed Aug 4, 2026

View reviewed changes

igcybers force-pushed the qualys_vmdr-show-qds-opt-in branch from fb9ffa5 to 11cfca6 Compare August 4, 2026 08:32

igcybers requested a review from efd6 August 4, 2026 08:35

set show_qds* parameters in the object

c2ffacd

igcybers force-pushed the qualys_vmdr-show-qds-opt-in branch from 11cfca6 to c2ffacd Compare August 4, 2026 08:59

Merge upstream main into qualys_vmdr-show-qds-opt-in

d989230

igcybers force-pushed the qualys_vmdr-show-qds-opt-in branch from 2462863 to d989230 Compare August 4, 2026 12:34

efd6 approved these changes Aug 4, 2026

View reviewed changes

efd6 merged commit c4e22fd into elastic:main Aug 4, 2026
4 checks passed

Navigation Menu

Uh oh!

qualys_vmdr: make QDS parameter opt-out - #20438

qualys_vmdr: make QDS parameter opt-out#20438
efd6 merged 4 commits into
elastic:mainfrom
cyber-smart:qualys_vmdr-show-qds-opt-in

igcybers commented Jul 31, 2026 •

edited

Loading

Uh oh!

cla-checker-service Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 31, 2026

Uh oh!

igcybers commented Jul 31, 2026

Uh oh!

efd6 Aug 4, 2026

Uh oh!

igcybers Aug 4, 2026 •

edited

Loading

Uh oh!

efd6 commented Aug 4, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 4, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Aug 4, 2026

Uh oh!

mergify Bot commented Aug 4, 2026

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

igcybers commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

cla-checker-service Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 31, 2026

Reviewers

Uh oh!

igcybers commented Jul 31, 2026

Uh oh!

efd6 Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

igcybers Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 commented Aug 4, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 4, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Aug 4, 2026

💚 Build Succeeded

Uh oh!

mergify Bot commented Aug 4, 2026

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

igcybers commented Jul 31, 2026 •

edited

Loading

cla-checker-service Bot commented Jul 31, 2026 •

edited

Loading

igcybers Aug 4, 2026 •

edited

Loading