qualys/scanner-replacement-toolkit repository overview

---

⁠QUALYS SCANNER REPLACEMENT PLATFORM

A self-service toolkit designed to help Qualys customers assess and replace their legacy and non-OEL scanner appliances with the latest release version.

---

⁠WHY THIS EXISTS

Qualys is deprecating legacy and non-OEL scanner appliances and software versions. This toolkit automates the process of identifying which appliances in your subscription need to be replaced and provides deployment templates to spin up scanners on the latest release version.

---

⁠HOW IT WORKS

The platform connects directly to the Qualys API to provide live status updates and orchestrate the full replacement pipeline: Pre-check -> Create Scanner -> Await Online -> Replace Config -> Decommission.

---

⁠QUICK START

See https://docs.qualys.com/en/scanner/replacement-automation-tool/get_started/overview.htm⁠ for full setup and usage instructions.

---

⁠SUPPORTED PLATFORMS

The toolkit supports the following target platforms for scanner replacement:

• VMware vSphere (Terraform auto-deploy + manual template generation)
• Amazon Web Services (AWS) (Terraform auto-deploy + manual template generation)

Auto-Deploy Support:

• VMware vSphere - Deploys via vsphere_virtual_machine with OVF import.
• AWS - Deploys via aws_instance with marketplace AMI auto-discovery.

More platforms coming in future releases.

---

⁠DOCUMENTATION

• User Guide :https://docs.qualys.com/en/scanner/replacement-automation-tool/get_started/overview.htm⁠
• Qualys API Limits: https://cdn2.qualys.com/docs/qualys-api-limits.pdf⁠ Official per-subscription API concurrency and rate-limit reference. Review this before running batch replacements with concurrency > 1.

---

⁠SECURITY MODEL

Security is a primary concern for this toolkit:

• No persistent credentials: The server mode uses session-based authentication. Your Qualys username and password are only kept in memory and are never written to disk.
• Localhost bound: By default, the server binds to 127.0.0.1 preventing external network access.
• CORS lockdown: Cross-Origin Resource Sharing is restricted to localhost to prevent browser-based attacks.
• Docker / remote access: The docker-compose.yml sets BIND_ADDRESS=0.0.0.0 so the container is reachable from the host network. Do NOT expose this to the public internet without TLS and a reverse-proxy with authentication.

---

⁠CONFIGURATION (.env)

PORT The port the web server listens on Default: 3001

QUALYS_PLATFORM Which Qualys platform to connect to (e.g., US1, EU1). Optional - auto-detected from the identifier character embedded in the username at login. Only set this to override auto-detection. Default: (auto-detected)

BIND_ADDRESS Network interface to bind to. Default 127.0.0.1 restricts to localhost. Set 0.0.0.0 for Docker/remote access, but do NOT expose to the internet without TLS. Default: 127.0.0.1

CORS_ORIGIN Allowed origin for API requests Default: http://localhost:3001⁠

---

⁠Note

Please test replacements in a dry-run or lab environment before executing in production.