Customize Controls

Controls are the building blocks of the policies used to measure and report compliance for a set of hosts. We provide many controls for you to choose from and you can customize them too. Controls play the key part in the compliance posture of resource.

System Controls

System-defined Control is a predefined control provided by Qualys. Few system-defined controls are customizable while few are not. The control indicator icon tells us if the control is customizable or not. Show me

User-Defined Controls

You can copy any system-defined control to make your own user-defined controls that you can customize to meet your needs.

AWS

2: Ensure console credentials unused for 90 days or greater are disabled

3: Ensure access keys unused for 90 days or greater are disabled

4: Ensure access key1 is rotated every 90 days or less

5: Ensure access key2 is rotated every 90 days or less

11: Ensure IAM password policy requires minimum length of 14 or greater

12: Ensure IAM password policy prevents password reuse

13: Ensure IAM password policy expires passwords within 90 days or less

18: Avoid the use of the root account

27: Ensure a log metric filter and alarm exist for unauthorized API calls

45: S3 Bucket Access Control List Grant Access to Everyone or Authenticated Users

56: Ensure database Instance is not listening on to a standard/default port

Azure

50013: Ensure that default Auditing policy for a SQL Server is configured to capture and retain the activity logs

50024: Ensure that LogProfile for a subscription is configured properly

50029: Disable RDP access on Network Security Groups from Internet (ANY IP) NETWORK_SECURITY_GROUP

Control Criticality

You can modify the criticality of any control to suit your need. If the control criticality needs to be changed to match your environment, you can select the control, select Change Criticality from quick action menu. Show me

Select the criticality you want to assign to the control and click Change Criticality. Show me

Note: When you change criticality, the revised control criticality for existing evaluations is effective on Monitor View upon next connector run.

Let us consider a scenario where a control with HIGH criticality evaluated three resources. Now, if you change the criticality of the control to LOW, the change in evaluation results reflects only after connector run. During the connector run, assume that only two resources get detected. The control evaluation results for resources that get detected post connector run will reflect (LOW criticality). However, control evaluation result for the resource that did not get detected post connector run will be counted as HIGH criticality.

Copy Control and Customize

Go to Policy > Controls and select the control to be customized, select Copy Control from the quick action menu. The Icon used to indicate that the control can be customized.

icon indicates that the control is customizable. 12 AWS and 2 Azure controls for customization. Show me

You can then modify the parameters of the control as per your requirement and save the customized control. The customized control is available to associate with policy and evaluate the resources.

(3) Set the expected value in Evaluation Parameter to 10. Change other aspects such as Evaluation Description, Evaluation Message as per your need. Click Next.

Can I edit controls?

Yes. Choose the user-defined control to be edited and choose Edit from the quick action menu. You can edit only user-defined controls. You cannot edit system-defined control.

Can I delete controls?

Yes. Choose the user-defined control to be deleted and choose Edit from the quick action menu. You can delete only user-defined controls. You cannot delete system-defined control.