Integration Name
Qualys Global AssetView [packages/qualys_gav]
Dataset Name
qualys_gav.asset
Integration Version
0.8.0
Agent Version
Latest (aligned with stack)
OS Version and Architecture
docker image from elastic-package
User Goal
Configure the Qualys GAV latest-asset transform destination (logs-qualys_gav_latest.asset) with lookup index mode so it can be used as the right-hand side of ES|QL LOOKUP JOIN.
Primary use case: enrich Qualys VMDR data with GAV asset inventory metadata (e.g. via host.id).
Example:
FROM security_solution-qualys_vmdr.vulnerability_latest
| LOOKUP JOIN logs-qualys_gav_latest.asset ON host.id
Reference: https://www.elastic.co/docs/reference/query-languages/esql/commands/lookup-join#parameters
Existing Features
The integration already ships a latest-asset transform that deduplicates inventory into logs-qualys_gav_latest.asset (alias → logs-qualys_gav_latest.dest_asset-2). That index works for FROM queries and dashboards, but not for LOOKUP JOIN, because its index mode is standard.
There is no integration setting to enable lookup mode. Manually changing index mode on a Fleet-managed transform destination is not durable across package upgrades.
Current transform destination template (packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml):
start: true
destination_index_template:
mappings:
dynamic: true
dynamic_templates:
- strings_as_keyword:
match_mapping_type: string
mapping:
ignore_above: 1024
type: keyword
date_detection: trueWhat did you see?
LOOKUP JOIN against logs-qualys_gav_latest.asset fails because the index is not configured with lookup index mode.
Anything else?
Suggested implementation:
- Add lookup index mode to
packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml:
destination_index_template:
settings:
index:
mode: lookup
-
Bump fleet_transform_version in transform.yml to recreate the transform destination on upgrade.
-
Document in the integration README that logs-qualys_gav_latest.asset supports ES|QL LOOKUP JOIN (Stack 9.1+).
Precedent: CrowdStrike integration uses the same pattern on transform destinations (packages/crowdstrike/elasticsearch/transform/latest_aidmaster/manifest.yml).
cc @smiller-elastic @mitchell-rutigliano
Integration Name
Qualys Global AssetView [packages/qualys_gav]
Dataset Name
qualys_gav.asset
Integration Version
0.8.0
Agent Version
Latest (aligned with stack)
OS Version and Architecture
docker image from elastic-package
User Goal
Configure the Qualys GAV latest-asset transform destination (
logs-qualys_gav_latest.asset) with lookup index mode so it can be used as the right-hand side of ES|QLLOOKUP JOIN.Primary use case: enrich Qualys VMDR data with GAV asset inventory metadata (e.g. via
host.id).Example:
Reference: https://www.elastic.co/docs/reference/query-languages/esql/commands/lookup-join#parameters
Existing Features
The integration already ships a latest-asset transform that deduplicates inventory into
logs-qualys_gav_latest.asset(alias →logs-qualys_gav_latest.dest_asset-2). That index works forFROMqueries and dashboards, but not forLOOKUP JOIN, because its index mode isstandard.There is no integration setting to enable lookup mode. Manually changing index mode on a Fleet-managed transform destination is not durable across package upgrades.
Current transform destination template (
packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml):What did you see?
LOOKUP JOINagainstlogs-qualys_gav_latest.assetfails because the index is not configured with lookup index mode.Anything else?
Suggested implementation:
packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml:Bump
fleet_transform_versionintransform.ymlto recreate the transform destination on upgrade.Document in the integration README that
logs-qualys_gav_latest.assetsupports ES|QLLOOKUP JOIN(Stack 9.1+).Precedent: CrowdStrike integration uses the same pattern on transform destinations (packages/crowdstrike/elasticsearch/transform/latest_aidmaster/manifest.yml).
cc @smiller-elastic @mitchell-rutigliano