Qualys: Alert When Firewall Product Is Not Detected on a Host
Alerts when Qualys reports a host missing a detectable firewall product during vulnerability management scanning.
FreeReviewedSigma · Low · v5
- Product
- qualys
- Author
- Alexandr Yampolskyi, SOC Prime (SigmaHQ), DRL 1.1
- Published
- 2019-03-19
- Updated
- 2026-07-31
What it detects
This rule flags Qualys vulnerability management scan results where the host reports that no firewall product was detected. Attackers rely on weakened network controls, and missing or unrecognized firewall protections can increase exposure to later exploitation and lateral movement. The detection relies on Qualys event telemetry indicating a security policy category finding with the text substring "Firewall Product Not Detected" in the reported vulnerability name.
Reporting behind it
- cisecurity.orghttps://www.cisecurity.org/controls/cis-controls-list/
- pcisecuritystandards.orghttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- nvlpubs.nist.govhttps://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-compliance/product/qualys/qualys_host_without_firewall.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
qualys-scan-indicates-firewall-product-not-detected-6b2066c8
title: "Qualys: Alert When Firewall Product Is Not Detected on a Host"
id: 401b4685-5f5d-4cbe-a78d-4f697f3f11cb
status: experimental
description: This rule flags Qualys vulnerability management scan results where the host reports that no firewall product was detected. Attackers rely on weakened network controls, and missing or unrecognized firewall protections can increase exposure to later exploitation and lateral movement. The detection relies on Qualys event telemetry indicating a security policy category finding with the text substring "Firewall Product Not Detected" in the reported vulnerability name.
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-compliance/product/qualys/qualys_host_without_firewall.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-19
modified: 2025-11-01
logsource:
product: qualys
detection:
selection:
event.category: Security Policy
host.scan.vuln_name|contains: Firewall Product Not Detected
condition: selection
level: low
license: DRL-1.1
related:
- id: 6b2066c8-3dc7-4db7-9db0-6cc1d7b0dde9
type: derived