Qualys Scan Indicates Firewall Product Not Detected

Alerts when Qualys reports a host missing a detectable firewall product during vulnerability management scanning.

FreeUnreviewedSigmalowv1

qualys-scan-indicates-firewall-product-not-detected-6b2066c8

title: Qualys Scan Indicates Firewall Product Not Detected
id: 401b4685-5f5d-4cbe-a78d-4f697f3f11cb
status: experimental
description: This rule flags Qualys vulnerability management scan events where the reported issue indicates that a firewall product was not detected. Attackers often rely on missing or misconfigured host security controls, and the lack of a detectable firewall can increase exposure to scanning and subsequent compromise attempts. The detection relies on Qualys telemetry, specifically Security Policy events and the scan vulnerability name containing 'Firewall Product Not Detected'.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-compliance/product/qualys/qualys_host_without_firewall.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-19
modified: 2025-11-01
logsource:
  product: qualys
detection:
  selection:
    event.category: Security Policy
    host.scan.vuln_name|contains: Firewall Product Not Detected
  condition: selection
level: low
license: DRL-1.1
related:
  - id: 6b2066c8-3dc7-4db7-9db0-6cc1d7b0dde9
    type: derived

What it detects

This rule flags Qualys vulnerability management scan events where the reported issue indicates that a firewall product was not detected. Attackers often rely on missing or misconfigured host security controls, and the lack of a detectable firewall can increase exposure to scanning and subsequent compromise attempts. The detection relies on Qualys telemetry, specifically Security Policy events and the scan vulnerability name containing 'Firewall Product Not Detected'.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.