Qualys

• New vulnerability foundRuns once for each vulnerability Qualys newly finds, or finds again after it was fixed, on a host, severity 4 and 5 by default, with the host and the QID. Vulnerabilities already found when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• Vulnerability fixedRuns once for each vulnerability a scan or agent finds fixed on a host, with the host, the QID and when it was fixed. Fixes made before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• Scan finishedRuns when a vulnerability scan finishes, ends in an error or is canceled, with its reference, title and state. Scans that ended before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New host foundRuns when Qualys finds a host for the first time, through a scan or an agent, with its address, name and operating system. Hosts already there when the workflow is turned on don't start it. How often it checks follows your workspace plan.
• Report finishedRuns when a report finishes in Report Share, with its id, title and format, ready for 'Download report'. Reports finished before the workflow was turned on don't start it. How often it checks follows your workspace plan.
• New remediation ticketRuns when a remediation ticket is opened, with its number, assignee, host and vulnerability. Tickets opened before the workflow was turned on don't start it. How often it checks follows your workspace plan.

• List hostsList host assets (servers, workstations, devices) with their IP, DNS name, operating system, TruRisk score and when they were last scanned, filtered by IP, asset group, operating system or scan date.
• List host detectionsList the vulnerabilities found on hosts, one row per detection, with its QID, severity, status (new, active, reopened or fixed), port and when it was found, filtered by host, severity, status or QID.
• Look up vulnerabilitiesLook up vulnerabilities in the Qualys KnowledgeBase by QID: title, severity, CVEs, CVSS scores, whether a patch exists, and the diagnosis, consequence and solution.
• Launch scanStart a vulnerability scan of IP addresses or asset groups now, with an option profile and, for internal hosts, scanner appliances. Returns the scan's reference.
• List scansList vulnerability scans with their state, target and launch time, filtered by state, type or when they were launched. Without dates, Qualys lists the last 30 days.
• Cancel scanCancel a running or queued vulnerability scan.
• List scan schedulesList scheduled vulnerability scans with their target, option profile, how often they run and when they next run.
• List option profilesList the option profiles vulnerability scans can use, and which is the default.
• List scanner appliancesList scanner appliances with whether each is online and how many scans it is running.
• List IPsList the IP addresses and ranges in the Qualys subscription, the ones that can be scanned.
• Add IPsAdd IP addresses or ranges to the Qualys subscription so they can be scanned. Needs a Manager or Unit Manager user, and may count towards your licence.
• List asset groupsList asset groups with their IPs, scanner appliances, business impact and owner.
• Create asset groupCreate an asset group of IP addresses, with comments, business impact and scanner appliances. Returns its id.
• Update asset groupChange an asset group: rename it, change its comments or business impact, and add or remove IPs and scanner appliances.
• Delete asset groupDelete an asset group. Scheduled scans of it are deactivated; the hosts stay.
• List reportsList the reports saved in Report Share with their state, format and when they expire.
• Launch reportStart a report from a report template, as PDF, CSV, XML, HTML or Word, optionally for some IPs, asset groups or scans. It runs in the background: 'List reports' shows when it's finished.
• Download reportDownload a finished report into the workspace's files. A CSV or XML report's text also comes back, for the next step to read.
• Delete reportDelete a saved report from Report Share. A report still running is canceled instead.
• List report templatesList the report templates reports can be launched from, with their type.
• List remediation ticketsList remediation tickets with their state, assignee, host and vulnerability, filtered by number, state, severity, host, QID or assignee. Up to 1,000 at a time.
• List tagsList asset tags, optionally those whose name contains some text, with their rule, colour, criticality and child tags.
• Create tagCreate a static asset tag, one you assign to assets by hand, with a colour and criticality.
• Delete tagDelete an asset tag and its child tags. Assets keep everything else.

No actions match that.