Which API Access?

[Heff]

We are loading up the Qualsys forwarder and have been specifically asked about the api access and whether we need scanner, reader or manager ?

I’m leaning toward manager to give us legit access to api, but obviously want only as much as needed.

Thanks

[tmccamant]

I would use a reader account, since you will only be pulling in the vulnerability information. Once the reader account has been created you will need to assign which asset groups you would like to pull into Splunk.

Qualys user definitions (https://qualysguard.qualys.com/qwebhelp/fo_help/user_accounts/users_user_role.htm)
- Manager. A Manager has full rights and access to all account resources, including all asset groups in the subscription. Managers have the same rights as the subscriber of the account, who was automatically assigned a Manager role.
- Scanner. A Scanner can launch maps and scans on assigned groups and generate reports based on the results.
- Reader. A Reader can view saved map and scan results for assigned groups and generate reports based on the results.