Connecting Tenable, Qualys or Rapid7

If you already run a vulnerability scanner, you do not need to replace it with Qorionix's own agent-based scanning to get findings into the exposure screen. Three scanners have a working connector: Tenable.io, Qualys VMDR and Rapid7 InsightVM. Each pulls existing findings from the scanner's own API — none of them starts a new scan.

Tenable.io

1. 1

   Generate an API key pair

   In Tenable.io, go to Settings → My Account → API Keys → Generate. Copy the Access Key and the Secret Key — the secret is shown once.

2. 2

   Choose a severity floor (optional)

   Findings below the severity you set here are skipped on import. Leave it unset to pull everything.

3. 3

   Connect it in Qorionix

   Under Integrations → Catalog → Tenable.io, choose Vulnerability findings, paste both keys, and press Test and save.

The connector uses Tenable's own bulk vulnerability exports API (the path Tenable's documentation recommends over paging the smaller workbenches endpoints), so a large scan history does not mean a slow or failing sync.

Qualys VMDR

1. 1

   Create a dedicated API user

   In Qualys, create a user with the VM module and API access enabled. A dedicated read-only user is recommended over reusing a personal login.

2. 2

   Find your platform URL

   Qualys → Help → About shows your platform API host. EU tenants are usually qualysapi.qualys.eu; confirm rather than assume.

3. 3

   Connect it in Qorionix

   Under Integrations → Catalog → Qualys VMDR, choose Vulnerability findings, enter the platform URL, username and password, and press Test and save.

Qualys's severity scale (1–5) is mapped onto Qorionix's severity levels; nothing is re-judged beyond that mapping.

Rapid7 InsightVM

1. 1

   Create an API user

   In the InsightVM console, create a user with API access and at least the Asset Owner role.

2. 2

   Connect it in Qorionix

   Under Integrations → Catalog → Rapid7 InsightVM, choose Vulnerability findings, enter the console URL and the API user's credentials, and press Test and save.

InsightVM's import resolves each distinct CVE once per poll rather than once per affected host, so a vulnerability shared across many machines does not multiply the number of upstream API calls.

How a finding is enriched

Every finding from any of the three, plus Qorionix's own vulnerability scanning, is cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalogue. A finding whose CVE is on that list is flagged and weighted more heavily in the tenant exposure score than severity alone — an actively exploited vulnerability is a stronger remediation signal than CVSS by itself.