qualys/scanner-replacement-toolkit repository overview

⁠Qualys Scanner Replacement Toolkit

A self-service web toolkit that finds the legacy and end-of-support (EOS) Qualys scanner appliances in your subscription and replaces them with current Oracle Linux (OEL)-based scanner appliances. Asset groups, scan schedules, and appliance settings move to the new scanner through the Qualys Replace Scanner Appliance API.

User guide (installation, Docker Compose setup, workflow, configuration): https://docs.qualys.com/en/scanner/replacement-automation-tool/get_started/overview.htm⁠

⁠What it does

• Assess - lists the scanner appliances in your subscription that need replacement.
• Deploy - provisions the new scanner on VMware vSphere or AWS, or generates deployment templates you run yourself. (Note: Additional virtualization platforms will be supported in upcoming releases.)
• Replace - creates the new appliance in Qualys, transfers the configuration from the old one, and optionally removes the old record.
• Track - shows live progress for every replacement.

⁠Quick start

docker run -d --name qualys-scanner-replacement \
  -p 127.0.0.1:3001:3001 \
  -e BIND_ADDRESS=0.0.0.0 \
  -v scanner-replacement-data:/app/data \
  --cap-drop ALL --security-opt no-new-privileges:true \
  --restart unless-stopped \
  qualys/scanner-replacement-toolkit:latest

Open http://localhost:3001⁠ and sign in with your Qualys credentials.

Docker Compose setup, VMware auto-deploy options, and all settings are in the user guide⁠.

⁠Requirements

• Docker Engine on an x86_64 (amd64) host.
• HTTPS access from the host to your Qualys platform API (and to vCenter or AWS for auto-deploy).
• A Qualys Manager or Unit Manager account.

⁠Tags

• latest - the most recent release.
• X.Y.Z - a specific release. Pin one for repeatable deployments.

⁠Security

The toolkit has no TLS or login page of its own. Keep it bound to localhost, or put it behind a reverse proxy with TLS and authentication. Never expose it to the internet.

⁠Before you start

• Start with one non-critical scanner appliance to confirm that your credentials, network access, and deployment settings work. A replacement cannot be undone once the configuration transfer starts.
• Do not replace a scanner appliance while scans that use it are running.

⁠Support

Contact Qualys Support or your Qualys Technical Account Manager.