Building an AppSec Program with Qualys WAS – Additional Configurations and Review & Confirm

This article (Parts 4–5) outlines advanced Qualys WAS configuration to optimize web app and API scanning, covering setup of authentication records (including TOTP via QBR), header injection (for WAF attribution and MFA session reuse), API endpoint definitions (Postman/OAS/Burp), allow/deny and POST-data exclusions, default DNS overrides, redundant links and path-fuzzing rules to reduce duplicate testing, and form training or Selenium for workflows; it also describes enabling separate malware monitoring scans and concludes with a review-and-confirm step, emphasizing the best practice to run discovery scans before vulnerability scans.