Overview
Qualys ETM can ingest mobile security data from Lookout through the Lookout Mobile Security Connector. The official connector documentation states that the integration can import mobile device records, and in the Assets & Findings mode it can also import associated OS CVE findings. This guide focuses on how to check whether the sync completed successfully and whether the expected device record and OS finding appear in Qualys.
A visible device in Qualys is not, by itself, proof that findings were imported. Likewise, the absence of a specific CVE does not prove there is no risk. Verification should compare the source device and a known OS CVE against the corresponding Qualys asset and finding after a completed sync.
What the Lookout connector imports
- Assets mode imports mobile device records only.
- Assets & Findings mode is the default and also imports associated OS CVE findings.
- The documented behavior is a full sync; do not assume incremental propagation per device.
Before you verify the sync
- Use one authorized, already activated test device that is in the connected scope.
- Choose a known OS CVE that is already associated with that device in the source system.
- Avoid using sensitive identifiers in public logs or screenshots.
- Record the connector’s selected data mode and the time of the last successful sync.
How to check whether the sync completed
- Confirm that the connector run is marked completed in the relevant Qualys integration or sync status view.
- Allow for the configured schedule and connector mapping to take effect before checking results.
- Do not treat a device’s visibility as proof that findings have synced.
- If the connector is configured for Assets & Findings, confirm both the asset record and the related OS CVE finding.
What to compare in Qualys
- Source device identity: verify that the Qualys asset corresponds to the selected test device.
- Source OS CVE: verify that the expected OS CVE appears as a finding on the matching Qualys asset.
- Status alignment: compare the source state and the imported asset or finding state after the completed sync.
- Scope alignment: confirm the device is within the connector’s connected scope, without assuming a per-device scope or immediate update path.
Common interpretation mistakes
- Mistaking a visible device for proof that findings imported.
- Assuming a missing CVE means the device is risk-free.
- Assuming incremental updates when the documentation describes full sync behavior.
- Expecting immediate propagation outside the documented schedule and mapping behavior.
Official references
Qualys official November 9 article: The Expanding Attack Surface Demands a New Operating Model
Qualys connector documentation: Lookout Mobile Security Connector
