Qualys Vulnerability Management, Detection and Response (VMDR)

{
    "@timestamp": "2026-08-05T21:44:21.686Z",
    "agent": {
        "ephemeral_id": "b0db066d-696a-4c82-a2a9-9a7436e32f00",
        "id": "960204fc-0824-4557-a45e-858a5f6c6c99",
        "name": "elastic-agent-90390",
        "type": "filebeat",
        "version": "8.19.11"
    },
    "cloud": {
        "instance": {
            "name": "noscore"
        }
    },
    "data_stream": {
        "dataset": "qualys_vmdr.asset_host_detection",
        "namespace": "94127",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "960204fc-0824-4557-a45e-858a5f6c6c99",
        "snapshot": false,
        "version": "8.19.11"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "qualys_vmdr.asset_host_detection",
        "id": "99999991",
        "ingested": "2026-08-05T21:44:24Z",
        "kind": "alert",
        "original": "{\"DETECTION_LIST\":{\"AFFECT_RUNNING_KERNEL\":\"0\",\"FIRST_FOUND_DATETIME\":\"2021-02-05T04:50:45Z\",\"IS_DISABLED\":\"0\",\"IS_IGNORED\":\"0\",\"LAST_FOUND_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_PROCESSED_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_TEST_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_UPDATE_DATETIME\":\"2024-03-08T20:15:41Z\",\"QID\":\"102\",\"SEVERITY\":\"5\",\"SSL\":\"0\",\"STATUS\":\"Active\",\"TIMES_FOUND\":\"5393\",\"TYPE\":\"Confirmed\",\"UNIQUE_VULN_ID\":\"99999991\"},\"DNS\":\"noscore.adfs.local\",\"DNS_DATA\":{\"DOMAIN\":\"adfs.local\",\"FQDN\":\"noscore.adfs.local\",\"HOSTNAME\":\"noscore\"},\"ID\":\"9\",\"IP\":\"10.50.2.119\",\"KNOWLEDGE_BASE\":{\"CATEGORY\":\"Security Policy\",\"CODE_MODIFIED_DATETIME\":\"2024-07-29T12:47:11Z\",\"CONSEQUENCE\":\"Apache no longer provides security updates for 1.x versions. Obsolete software is more vulnerable to viruses and other attacks.\\u003cP\\u003e\",\"CVE_LIST\":[\"CVE-2019-14835\"],\"CVSS\":{\"BASE\":{\"#text\":\"10.0\",\"source\":\"service\"},\"TEMPORAL\":\"8.5\",\"VECTOR_STRING\":\"CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:C\"},\"CVSS_V3\":{\"BASE\":\"10.0\",\"CVSS3_VERSION\":\"3.1\",\"TEMPORAL\":\"9.1\",\"VECTOR_STRING\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C\"},\"DIAGNOSIS\":\"On August 5, 2015, the Apache Logging Services Project Management Committee (PMC) has announced that the Log4j 1.x logging framework has reached its end of life (EOL) and is no longer officially supported.\\u003cBR\\u003e\\n\\n    \\u003cP\\u003eQID Detection: (Authenticated) - Linux\\u003cBR\\u003e\\n    This QID uses the OS package manager, locate command and ls proc command to check vulnerable versions of log4j\\u003cP\\u003e\\n\\n    \\u003cP\\u003eQID Detection: (Authenticated) - MacOS\\u003cBR\\u003e\\n    This QID uses the locate command and mdfind command to check vulnerable versions of log4j\\u003cBR\\u003e\\n\\n    QID Detection: (Authenticated) - Windows\\u003cBR\\u003e\\n    On Windows system, the QID identifies vulnerable instance of log4j via WMI query to check log4j included in the running processes via command-line.\\n    \\u003cP\\u003e\",\"DISCOVERY\":{\"AUTH_TYPE_LIST\":{\"AUTH_TYPE\":[\"Unix\",\"Windows\"]},\"REMOTE\":\"0\"},\"LAST_SERVICE_MODIFICATION_DATETIME\":\"2024-07-29T12:47:11Z\",\"PATCHABLE\":\"0\",\"PCI_FLAG\":\"1\",\"PUBLISHED_DATETIME\":\"2022-01-12T13:25:56Z\",\"QID\":\"102\",\"SEVERITY_LEVEL\":\"5\",\"SOFTWARE_LIST\":{\"SOFTWARE\":[{\"PRODUCT\":\"log4j\",\"VENDOR\":\"apache\"}]},\"SOLUTION\":\"Customers are advised to upgrade to Apache Log4j 2.X, for more information please refer to \\u003cA HREF=\\\"https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces\\\" TARGET=\\\"_blank\\\"\\u003e Apache Blog\\u003c/A\\u003e.\\u003cBR\\u003e\",\"THREAT_INTELLIGENCE\":{\"THREAT_INTEL\":[{\"#text\":\"High_Lateral_Movement\",\"id\":\"4\"},{\"#text\":\"Easy_Exploit\",\"id\":\"5\"},{\"#text\":\"High_Data_Loss\",\"id\":\"6\"},{\"#text\":\"Denial_of_Service\",\"id\":\"7\"},{\"#text\":\"No_Patch\",\"id\":\"8\"},{\"#text\":\"Privilege_Escalation\",\"id\":\"13\"},{\"#text\":\"Remote_Code_Execution\",\"id\":\"15\"}]},\"TITLE\":\"EOL/Obsolete Software: Apache Log4j 1.X Detected\",\"VENDOR_REFERENCE_LIST\":{\"VENDOR_REFERENCE\":[{\"ID\":\"Apache Log4j Security Advisory\",\"URL\":\"https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces\"}]},\"VULN_TYPE\":\"Vulnerability\"},\"LAST_PC_SCANNED_DATE\":\"2023-06-28T09:58:12Z\",\"LAST_SCAN_DATETIME\":\"2023-07-03T06:25:17Z\",\"LAST_VM_SCANNED_DATE\":\"2023-07-03T06:23:47Z\",\"LAST_VM_SCANNED_DURATION\":\"1113\",\"NETBIOS\":\"NOSCORE\",\"OS\":\"Windows 2016/2019/10\",\"TRACKING_METHOD\":\"IP\"}",
        "type": [
            "info"
        ]
    },
    "host": {
        "domain": "NOSCORE",
        "hostname": "noscore",
        "id": "9",
        "ip": [
            "10.50.2.119"
        ],
        "name": "noscore.adfs.local",
        "os": {
            "full": "Windows 2016/2019/10",
            "platform": "windows",
            "type": "windows"
        }
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "vendor": "Qualys VMDR"
    },
    "qualys_vmdr": {
        "asset_host_detection": {
            "dns": "noscore.adfs.local",
            "dns_data": {
                "domain": "adfs.local",
                "fqdn": "noscore.adfs.local",
                "hostname": "noscore"
            },
            "id": "9",
            "interval_id": "2069808d-baa0-4408-8333-f15c65f6390a",
            "interval_start": "2026-08-05T21:44:21.683Z",
            "ip": "10.50.2.119",
            "knowledge_base": {
                "category": "Security Policy",
                "consequence": {
                    "value": "Apache no longer provides security updates for 1.x versions. Obsolete software is more vulnerable to viruses and other attacks.<P>"
                },
                "cve_list": [
                    "CVE-2019-14835"
                ],
                "cvss": {
                    "base_obj": {
                        "#text": "10.0",
                        "source": "service"
                    },
                    "temporal": "8.5",
                    "vector_string": "CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:U/RC:C"
                },
                "cvss_v3": {
                    "base": "10.0",
                    "temporal": "9.1",
                    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C",
                    "version": "3.1"
                },
                "diagnosis": {
                    "value": "On August 5, 2015, the Apache Logging Services Project Management Committee (PMC) has announced that the Log4j 1.x logging framework has reached its end of life (EOL) and is no longer officially supported.<BR>\n\n    <P>QID Detection: (Authenticated) - Linux<BR>\n    This QID uses the OS package manager, locate command and ls proc command to check vulnerable versions of log4j<P>\n\n    <P>QID Detection: (Authenticated) - MacOS<BR>\n    This QID uses the locate command and mdfind command to check vulnerable versions of log4j<BR>\n\n    QID Detection: (Authenticated) - Windows<BR>\n    On Windows system, the QID identifies vulnerable instance of log4j via WMI query to check log4j included in the running processes via command-line.\n    <P>"
                },
                "discovery": {
                    "auth_type_list": {
                        "value": [
                            "Unix",
                            "Windows"
                        ]
                    },
                    "remote": 0
                },
                "last": {
                    "service_modification_datetime": "2024-07-29T12:47:11.000Z"
                },
                "patchable": false,
                "pci_flag": true,
                "published_datetime": "2022-01-12T13:25:56.000Z",
                "qid": "102",
                "severity_level": "Urgent",
                "software_list": [
                    {
                        "product": "log4j",
                        "vendor": "apache"
                    }
                ],
                "solution": {
                    "value": "Customers are advised to upgrade to Apache Log4j 2.X, for more information please refer to <A HREF=\"https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces\" TARGET=\"_blank\"> Apache Blog</A>.<BR>"
                },
                "status": "found",
                "threat_intelligence": {
                    "intel": [
                        {
                            "id": "4",
                            "text": "High_Lateral_Movement"
                        },
                        {
                            "id": "5",
                            "text": "Easy_Exploit"
                        },
                        {
                            "id": "6",
                            "text": "High_Data_Loss"
                        },
                        {
                            "id": "7",
                            "text": "Denial_of_Service"
                        },
                        {
                            "id": "8",
                            "text": "No_Patch"
                        },
                        {
                            "id": "13",
                            "text": "Privilege_Escalation"
                        },
                        {
                            "id": "15",
                            "text": "Remote_Code_Execution"
                        }
                    ]
                },
                "title": "EOL/Obsolete Software: Apache Log4j 1.X Detected",
                "vendor_reference_list": [
                    {
                        "id": "Apache Log4j Security Advisory",
                        "url": "https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces"
                    }
                ],
                "vuln_type": "Vulnerability"
            },
            "last_pc_scanned_date": "2023-06-28T09:58:12.000Z",
            "last_scan_datetime": "2023-07-03T06:25:17.000Z",
            "last_vm_scanned_date": "2023-07-03T06:23:47.000Z",
            "last_vm_scanned_duration": 1113,
            "netbios": "NOSCORE",
            "os": "Windows 2016/2019/10",
            "tracking_method": "IP",
            "vulnerability": {
                "affect_running_kernel": "0",
                "first_found_datetime": "2021-02-05T04:50:45.000Z",
                "is_disabled": false,
                "is_ignored": false,
                "last_found_datetime": "2024-03-08T20:15:41.000Z",
                "last_processed_datetime": "2024-03-08T20:15:41.000Z",
                "last_test_datetime": "2024-03-08T20:15:41.000Z",
                "last_update_datetime": "2024-03-08T20:15:41.000Z",
                "qid": 102,
                "severity": 5,
                "ssl": "0",
                "status": "Active",
                "times_found": 5393,
                "type": "Confirmed",
                "unique_vuln_id": "99999991"
            }
        }
    },
    "related": {
        "hosts": [
            "noscore",
            "noscore.adfs.local",
            "9",
            "NOSCORE"
        ],
        "ip": [
            "10.50.2.119"
        ]
    },
    "resource": {
        "id": "9",
        "name": "noscore.adfs.local"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "qualys_vmdr-asset_host_detection",
        "provider_cloud_data"
    ],
    "vulnerability": {
        "category": [
            "Security Policy"
        ],
        "classification": "CVSS",
        "description": "On August 5, 2015, the Apache Logging Services Project Management Committee (PMC) has announced that the Log4j 1.x logging framework has reached its end of life (EOL) and is no longer officially supported.<BR>\n\n    <P>QID Detection: (Authenticated) - Linux<BR>\n    This QID uses the OS package manager, locate command and ls proc command to check vulnerable versions of log4j<P>\n\n    <P>QID Detection: (Authenticated) - MacOS<BR>\n    This QID uses the locate command and mdfind command to check vulnerable versions of log4j<BR>\n\n    QID Detection: (Authenticated) - Windows<BR>\n    On Windows system, the QID identifies vulnerable instance of log4j via WMI query to check log4j included in the running processes via command-line.\n    <P>",
        "enumeration": "CVE",
        "id": [
            "CVE-2019-14835"
        ],
        "reference": [
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14835"
        ],
        "scanner": {
            "vendor": "Qualys"
        },
        "score": {
            "base": 10,
            "version": "3.1"
        },
        "severity": "Critical",
        "title": "EOL/Obsolete Software: Apache Log4j 1.X Detected"
    }
}

{
    "@timestamp": "2023-06-29T12:20:46.000Z",
    "agent": {
        "ephemeral_id": "da0816f0-0acb-432d-aabc-40ff74ab0b83",
        "id": "af521d3d-fb8f-4a9e-b30a-9c41a680f7d2",
        "name": "elastic-agent-33894",
        "type": "filebeat",
        "version": "8.19.11"
    },
    "data_stream": {
        "dataset": "qualys_vmdr.knowledge_base",
        "namespace": "64767",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "af521d3d-fb8f-4a9e-b30a-9c41a680f7d2",
        "snapshot": false,
        "version": "8.19.11"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "qualys_vmdr.knowledge_base",
        "id": "11830",
        "ingested": "2026-02-25T04:32:39Z",
        "kind": "alert",
        "original": "{\"CATEGORY\":\"CGI\",\"CONSEQUENCE\":\"\",\"CVE_LIST\":[\"CVE-2022-31629\",\"CVE-2022-31628\"],\"DIAGNOSIS\":\"\",\"DISCOVERY\":{\"REMOTE\":\"1\"},\"LAST_SERVICE_MODIFICATION_DATETIME\":\"2023-06-29T12:20:46Z\",\"PATCHABLE\":\"0\",\"PCI_FLAG\":\"1\",\"PUBLISHED_DATETIME\":\"2017-06-05T21:34:49Z\",\"QID\":\"11830\",\"SEVERITY_LEVEL\":\"2\",\"SOFTWARE_LIST\":{\"SOFTWARE\":[{\"PRODUCT\":\"\",\"VENDOR\":\"\"}]},\"SOLUTION\":\"\",\"THREAT_INTELLIGENCE\":{\"THREAT_INTEL\":[{\"id\":\"8\"}]},\"TITLE\":\"\",\"VULN_TYPE\":\"Vulnerability\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "qualys_vmdr": {
        "knowledge_base": {
            "category": "CGI",
            "cve_list": [
                "CVE-2022-31629",
                "CVE-2022-31628"
            ],
            "discovery": {
                "remote": 1
            },
            "last": {
                "service_modification_datetime": "2023-06-29T12:20:46.000Z"
            },
            "patchable": false,
            "pci_flag": true,
            "published_datetime": "2017-06-05T21:34:49.000Z",
            "qid": "11830",
            "severity_level": "2",
            "threat_intelligence": {
                "intel": [
                    {
                        "id": "8"
                    }
                ]
            },
            "vuln_type": "Vulnerability"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "qualys_vmdr-knowledge_base"
    ],
    "vulnerability": {
        "category": [
            "CGI"
        ],
        "id": [
            "CVE-2022-31629",
            "CVE-2022-31628"
        ],
        "severity": "Medium"
    }
}

{
    "@timestamp": "2024-01-18T12:45:24.000Z",
    "agent": {
        "ephemeral_id": "e216870f-7101-4fad-9724-9b71ed9ad95c",
        "id": "15eb4582-ca67-48f0-9af3-72657ed5967e",
        "name": "elastic-agent-45371",
        "type": "filebeat",
        "version": "8.19.11"
    },
    "data_stream": {
        "dataset": "qualys_vmdr.user_activity",
        "namespace": "32843",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "15eb4582-ca67-48f0-9af3-72657ed5967e",
        "snapshot": false,
        "version": "8.19.11"
    },
    "event": {
        "action": "request",
        "agent_id_status": "verified",
        "category": [
            "api"
        ],
        "dataset": "qualys_vmdr.user_activity",
        "ingested": "2026-02-25T04:33:31Z",
        "kind": "event",
        "original": "{\"Action\":\"request\",\"Date\":\"2024-01-18T12:45:24Z\",\"Details\":\"API: /api/2.0/fo/activity_log/index.php\",\"Module\":\"auth\",\"User IP\":\"10.113.195.136\",\"User Name\":\"john\",\"User Role\":\"Reader\"}",
        "provider": "auth",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "API: /api/2.0/fo/activity_log/index.php",
    "qualys_vmdr": {
        "user_activity": {
            "Action": "request",
            "Date": "2024-01-18T12:45:24Z",
            "Details": "API: /api/2.0/fo/activity_log/index.php",
            "Module": "auth",
            "User_IP": "10.113.195.136",
            "User_Name": "john",
            "User_Role": "Reader"
        }
    },
    "related": {
        "ip": [
            "10.113.195.136"
        ],
        "user": [
            "john"
        ]
    },
    "source": {
        "ip": "10.113.195.136"
    },
    "tags": [
        "preserve_duplicate_custom_fields",
        "preserve_original_event",
        "forwarded",
        "qualys_vmdr-user_activity"
    ],
    "user": {
        "name": "john",
        "roles": [
            "Reader"
        ]
    }
}