Details
| ID | qualys_fim |
|---|---|
| Provider | Qualys |
| Category | IT Services |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Qualys FIM: File Integrity Monitoring
Log and track file changes across global IT systems.
This integration was integrated and tested with version 2.6.0.0-23 of qualys_fim
Configure qualys_fim in Cortex
| Parameter | Description | Required |
|---|---|---|
| Username | Username for authentication | True |
| Password | Password for authentication | True |
| Qualys API Platform URL | The Qualys API server URL that you should use for API requests depends on the platform where your account is located. Platforms and URLS: Qualys US Platform 1: https://gateway.qg1.apps.qualys.com Qualys US Platform 2: https://gateway.qg2.apps.qualys.com Qualys US Platform 3: https://gateway.qg3.apps.qualys.com Qualys EU Platform 1: https://gateway.qg1.apps.qualys.eu Qualys EU Platform 2: https://gateway.qg2.apps.qualys.eu Qualys India Platform 1: https://gateway.qg1.apps.qualys.in Qualys Private Cloud Platform(Custom Platform): https://gateway.<customer_base_url> | True |
| Fetch incidents | Fetch incidents | False |
| Fetch time | First fetch timestamp (<number> <time unit>) e.g., 12 hours, 7 days | False |
| Incident Type | Incident type | False |
| Max Fetch | Max Fetch is limited to 200 incidents per fetch. Choose a value lower than 200. | False |
| Fetch Filter | Filter the incidents fetching by providing a query using Qualys syntax i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm | False |
| Insecure | Trust any certificate (not secure) | False |
| Proxy | Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
qualys-fim-events-list
Retrieve a list of all FIM events from the current user account.
Base Command
qualys-fim-events-list
Input
| Argument Name | Description | Required |
|---|---|---|
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| incident_ids | Comma-separated list of incident IDs to be included while searching for events in incidents. | Optional |
| sort | The method by which to sort the requested events. Possible values: “most_recent” and “least_recent”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Events.id | str | Event ID. |
| QualysFIM.Events.fullPath | str | Full path of the event. |
| QualysFIM.Events.dateTime | str | Date/time the event occurred. |
| QualysFIM.Events.severity | int | Event severity. |
| QualysFIM.Events.agentId | str | Agent ID. |
Command Example
!qualys-fim-events-list limit=12 sort=least_recent filter=severity:4
Context Example
{
"QualysFIM": {
"Event": [
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 320,
"userID": "1-2-3-4",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "User",
"name": "DC.user.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:16:57.843+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\LogFiles\\Sum\\Svc.log",
"id": "de361739-a082-3240-8459-786b8ed5fa3b",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Svc.log",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "",
"process": "",
"processID": 4,
"userID": "1-2-3-4",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:17:02.606+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\SOFTWARE.LOG2",
"id": "a123456",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "SOFTWARE.LOG2",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 400,
"userID": "S-1-5-19",
"userName": "nt authority\\local service"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:17:52.405+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-Known Folders API Service.evtx",
"id": "366b1576-57f2-335f-9929-3026f5111767",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Microsoft-Windows-Known Folders API Service.evtx",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.792+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.743+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"id": "ea119f31-162a-3d0c-b2f7-01b32b6bc015",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"id": "16aff3b1-6198-3996-bfb7-ee99cd3bbe2d",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.796+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"id": "8c96931f-db80-3e47-a79a-a0585ec77037",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:57.276+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"id": "421c080f-ebae-35ca-8ad4-19ac62554a0c",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.785+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"id": "0cf60a82-b006-385a-ba14-f666733a063b",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"id": "0e5d5385-8dac-31a8-846c-29755c73cf88",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.785+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.768+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"id": "68047fa3-8f25-3063-bce8-0b988b87190c",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:57.276+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.768+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"id": "5d6084f2-3a47-3c71-8131-ebd2f1d7c684",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Attributes",
"actor": {
"imagePath": "",
"process": "",
"processID": 4,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:46.955+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\SOFTWARE.LOG2",
"id": "2e84bdd4-5395-3549-a29f-548e3aca0e83",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "SOFTWARE.LOG2",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:23:59.023+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
}
]
}
}
Human Readable Output
Listed 12 Events
id severity dateTime agentId fullPath de361739-a082-3240-8459-786b8ed5fa3b 4 2021-01-17 16:16:57 12345678 \Device\HarddiskVolume2\Windows\System32\LogFiles\Sum\Svc.log a123456 4 2021-01-17 16:17:02 12345678 \Device\HarddiskVolume2\Windows\System32\config\SOFTWARE.LOG2 366b1576-57f2-335f-9929-3026f5111767 4 2021-01-17 16:17:52 12345678 \Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx ea119f31-162a-3d0c-b2f7-01b32b6bc015 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf 16aff3b1-6198-3996-bfb7-ee99cd3bbe2d 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms 8c96931f-db80-3e47-a79a-a0585ec77037 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf 421c080f-ebae-35ca-8ad4-19ac62554a0c 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms 0cf60a82-b006-385a-ba14-f666733a063b 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms 0e5d5385-8dac-31a8-846c-29755c73cf88 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms 68047fa3-8f25-3063-bce8-0b988b87190c 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms 5d6084f2-3a47-3c71-8131-ebd2f1d7c684 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms 2e84bdd4-5395-3549-a29f-548e3aca0e83 4 2021-01-17 16:18:46 12345678 \Device\HarddiskVolume2\Windows\System32\config\SOFTWARE.LOG2
qualys-fim-event-get
Retrieve information about a given event, by event ID.
Base Command
qualys-fim-event-get
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | ID of the event to retrieve information about. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Event.id | str | Event ID. |
| QualysFIM.Event.fullPath | str | Full path of the event. |
| QualysFIM.Event.dateTime | str | Date/time the event occurred. |
| QualysFIM.Event.name | str | Event name. |
| QualysFIM.Event.severity | int | Event severity. |
| QualysFIM.Event.action | str | Event action. |
| QualysFIM.Event.incidentId | str | Event ID. |
| QualysFIM.Event.profiles | str | List of all monitoring profiles name. |
Command Example
!qualys-fim-event-get event_id=de361739-a082-3240-8459-786b8ed5fa3b
Context Example
{
"QualysFIM": {
"Event": {
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 320,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:16:57.843+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\LogFiles\\Sum\\Svc.log",
"id": "de361739-a082-3240-8459-786b8ed5fa3b",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Svc.log",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
}
}
}
Human Readable Output
Found Event
name action id severity action incidentId profiles type dateTime fullPath Svc.log Content de361739-a082-3240-8459-786b8ed5fa3b 4 Content 4710aa44-8d69-4c00-8013-737768cb54be test_01 File 2021-01-17 16:16:57 \Device\HarddiskVolume2\Windows\System32\LogFiles\Sum\Svc.log
qualys-fim-incidents-list
Retrieve a list of all FIM incidents from the current user account.
Base Command
qualys-fim-incidents-list
Input
| Argument Name | Description | Required |
|---|---|---|
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| attributes | Comma-separated list of attributes to include in the response. By default, all attributes will be returned in the result, i.e., attributes=”attributes=name,id”. | Optional |
| sort | The method by which to sort the requested events. Possible values: “most_recent” and “least_recent”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Incidents.id | str | Incident ID. |
| QualysFIM.Incidents.name | str | Incident name. |
| QualysFIM.Incidents.type | str | Incident type. |
| QualysFIM.Incidents.occurred | str | Indicates when the incident was created. |
| QualysFIM.Incidents.username | str | Name of the user who created this incident. |
| QualysFIM.Incidents.status | str | Incident status. |
Command Example
!qualys-fim-incidents-list sort=least_recent limit=15 attributes=name,status,id filter=status:closed
Context Example
{
"QualysFIM": {
"Incident": [
{
"id": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Deletion of Log Files",
"status": "CLOSED"
},
{
"id": "179e5d4e-1153-4d12-9980-4807b78fee62",
"name": "test700",
"status": "CLOSED"
},
{
"id": "b53eac81-902a-4c38-aee0-11f3b62d92fb",
"name": "w2www",
"status": "CLOSED"
},
{
"id": "b1f8c69b-e6ff-4470-8cf1-b37bd793d90d",
"name": "ppp3",
"status": "CLOSED"
},
{
"id": "b576c51b-480a-44d2-a19e-98b2c6cda4af",
"name": "www",
"status": "CLOSED"
},
{
"id": "497ab672-c65b-42c1-a913-8c62a8262cce",
"name": "rrr",
"status": "CLOSED"
},
{
"id": "7b182a08-413e-4777-9493-9a23eb8c7e9e",
"name": "testtest2",
"status": "CLOSED"
},
{
"id": "2ebf1510-2fa3-4e53-9475-a9377cb81673",
"name": "test_incident_31",
"status": "CLOSED"
},
{
"id": "61c90caf-ea98-45eb-82db-469a27105e91",
"name": "test 15",
"status": "CLOSED"
},
{
"id": "7b63aed9-b849-4c49-8b33-b6bf56bcfc79",
"name": "ppp",
"status": "CLOSED"
},
{
"id": "d223968d-fa86-43c2-b7d6-4de0e2100a0d",
"name": "777",
"status": "CLOSED"
},
{
"id": "2ad82774-d6e9-4e33-913c-d6a1729530e0",
"name": "ll2",
"status": "CLOSED"
},
{
"id": "c5815a31-508b-469e-8990-e81ce2c6f33e",
"name": "testtest1",
"status": "CLOSED"
},
{
"id": "b6997b4d-8451-438b-9333-0f1ec81b870c",
"name": "test100",
"status": "CLOSED"
},
{
"id": "a9be84fd-5a7f-45b1-9f69-b1507ab2b218",
"name": "wwww",
"status": "CLOSED"
}
]
}
}
Human Readable Output
Listed 15 Incidents
id name status 4710aa44-8d69-4c00-8013-737768cb54be Deletion of Log Files CLOSED 179e5d4e-1153-4d12-9980-4807b78fee62 test700 CLOSED b53eac81-902a-4c38-aee0-11f3b62d92fb w2www CLOSED b1f8c69b-e6ff-4470-8cf1-b37bd793d90d ppp3 CLOSED b576c51b-480a-44d2-a19e-98b2c6cda4af www CLOSED 497ab672-c65b-42c1-a913-8c62a8262cce rrr CLOSED 7b182a08-413e-4777-9493-9a23eb8c7e9e testtest2 CLOSED 2ebf1510-2fa3-4e53-9475-a9377cb81673 test_incident_31 CLOSED 61c90caf-ea98-45eb-82db-469a27105e91 test 15 CLOSED 7b63aed9-b849-4c49-8b33-b6bf56bcfc79 ppp CLOSED d223968d-fa86-43c2-b7d6-4de0e2100a0d 777 CLOSED 2ad82774-d6e9-4e33-913c-d6a1729530e0 ll2 CLOSED c5815a31-508b-469e-8990-e81ce2c6f33e testtest1 CLOSED b6997b4d-8451-438b-9333-0f1ec81b870c test100 CLOSED a9be84fd-5a7f-45b1-9f69-b1507ab2b218 wwww CLOSED
qualys-fim-incidents-get-events
Retrieve a list of the events logged under an incident.
Base Command
qualys-fim-incidents-get-events
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | ID of the incident to retrieve the events for. | Required |
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| attributes | Comma-separated list of attributes to include in the response. By default, all attributes will be returned in the result, i.e., attributes=”attributes=name,id”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.IncidentEvents.id | str | Event ID. |
| QualysFIM.IncidentEvents.name | str | Event name. |
| QualysFIM.IncidentEvents.severity | str | Event severity. |
| QualysFIM.IncidentEvents.type | str | Event type. |
| QualysFIM.IncidentEvents.occurred | str | Indicates when the event was created. |
| QualysFIM.IncidentEvents.username | str | Name of the user who created this incident. |
| QualysFIM.IncidentEvents.status | str | Incident status. |
| QualysFIM.IncidentEvents.action | str | Action that was taken that triggered the event creation. |
Command Example
!qualys-fim-incidents-get-events incident_id=4710aa44-8d69-4c00-8013-737768cb54be limit=7 attributes=id,name,type page_number=2 filter=action:create
Context Example
{
"QualysFIM": {
"Event": [
{
"id": "85873770-2c46-3c1c-94f6-a1fd117ca504",
"name": "8fe303d4743fc547b447af276bb19008",
"type": "File"
},
{
"id": "2e3ca9c5-354f-3f3d-a16b-c390b3b139d2",
"name": "6f3604d7c44b1b44b1addd026d40f547",
"type": "File"
},
{
"id": "cb8fd91a-5f0a-374e-9ccc-a1d762273322",
"name": "tw-4080-41f0-b2f98d.tmp",
"type": "File"
},
{
"id": "b267ddd7-308d-33f6-863e-fc85efaae6de",
"name": "SRUtmp.log",
"type": "File"
},
{
"id": "b129d76f-827f-3f1e-babb-e96fbfbdc697",
"name": "oem117.cat",
"type": "File"
},
{
"id": "87399be0-69fe-3881-85a1-b01ce1288672",
"name": "EtwRTTerminal-Services-LSM-ApplicationLag-6812.etl",
"type": "File"
},
{
"id": "0636da15-3c33-359f-9574-0bbc2d331e8a",
"name": "SRUtmp.log",
"type": "File"
}
]
}
}
Human Readable Output
Listed 7 Events From Incident
id name type 85873770-2c46-3c1c-94f6-a1fd117ca504 8fe303d4743fc547b447af276bb19008 File 2e3ca9c5-354f-3f3d-a16b-c390b3b139d2 6f3604d7c44b1b44b1addd026d40f547 File cb8fd91a-5f0a-374e-9ccc-a1d762273322 tw-4080-41f0-b2f98d.tmp File b267ddd7-308d-33f6-863e-fc85efaae6de SRUtmp.log File b129d76f-827f-3f1e-babb-e96fbfbdc697 oem117.cat File 87399be0-69fe-3881-85a1-b01ce1288672 EtwRTTerminal-Services-LSM-ApplicationLag-6812.etl File 0636da15-3c33-359f-9574-0bbc2d331e8a SRUtmp.log File
qualys-fim-incident-create
Create a manual FIM incident of type “DEFAULT”.
Base Command
qualys-fim-incident-create
Input
| Argument Name | Description | Required |
|---|---|---|
| from_date | Date from which to start the event search. Example format: yyyy-mm-dd, 2021-01-01. | Optional |
| to_date | Date at which to stop the event search. Example format: yyyy-mm-dd, 2021-02-30. | Optional |
| filters | Filter the events list by providing a query using Qualys syntax. i.e., “dateTime : [‘2021-01-01’..’2021-03-29’]. When you use this argument it will overwrite the “from_date” and “to_date” arguments. If you don’t use the filter, the query will include the events from the last 24 hours. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| name | The name of the incident. Must be less than 128 characters. | Required |
| reviewers | Reviewers who will approve the incident. | Optional |
| comment | Comments for approval of the incident. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.CreatedIncident.id | str | Incident ID. |
| QualysFIM.CreatedIncident.name | str | Incident name. |
| QualysFIM.CreatedIncident.occurred | str | Indicates when the incident was created. |
| QualysFIM.CreatedIncident.username | str | Name of the user who created the incident. |
| QualysFIM.CreatedIncident.status | str | Incident status. |
| QualysFIM.CreatedIncident.reviewers | str | List of reviewers who will approve the incident. |
Command Example
!qualys-fim-incident-create name=testtest7 comment=new_incident filters="dateTime: ['2021-01-01'..'2021-02-15']"
Context Example
{
"QualysFIM": {
"CreatedIncident": {
"approvalType": "MANUAL",
"customerId": "12345678999",
"filters": [
"dateTime: ['2021-01-01'..'2021-02-15']"
],
"id": "5f9f5504-46eb-4a30-b022-fd0dba7758eb",
"name": "testtest7",
"reviewers": [
"useruser"
],
"type": "DEFAULT",
"userInfo": {
"date": 1613469168294,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
}
}
}
}
Human Readable Output
Created New Incident: testtest7
id name reviewers username occurred filters approvalType 5f9f5504-46eb-4a30-b022-fd0dba7758eb testtest7 useruser Qmasters 2021-02-16 09:52:48 dateTime: [‘2021-01-01’..’2021-02-15’] MANUAL
qualys-fim-incident-approve
Mark an existing FIM incident as approved.
Base Command
qualys-fim-incident-approve
Input
| Argument Name | Description | Required |
|---|---|---|
| approval_status | The approval status of the incident. Possible values: “APPROVED”, “POLICY_VIOLATION”, “UNAPPROVED”. | Required |
| change_type | Type of incidents. Possible values: “MANUAL”, “AUTOMATED”, “COMPROMISE”, “OTHER”. | Required |
| comment | Comments for the incidents. | Required |
| incident_id | incident ID to approve. | Required |
| disposition_category | The category of the incident created by the rule. Possible values: “PATCHING”, “PRE_APPROVED_CHANGE_CONTROL”, “CONFIGURATION_CHANGE”, “HUMAN_ERROR”, “DATA_CORRUPTION”, “EMERGENCY_CHANGE”, “CHANGE_CONTROL_VIOLATION”, “GENERAL_HACKING”, “MALWARE”. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.ApprovedIncident.id | str | Incident ID. |
| QualysFIM.ApprovedIncident.name | str | Incident name. |
| QualysFIM.ApprovedIncident.type | str | Incident type. |
| QualysFIM.ApprovedIncident.filterFromDate | str | The date from which to filter the approved incident. |
| QualysFIM.ApprovedIncident.filterToDate | str | The date until when to filter the approved incident. |
| QualysFIM.ApprovedIncident.approvalDate | str | Approval date of the incident. |
| QualysFIM.ApprovedIncident.approvalStatus | str | Approval status of the incident. |
| QualysFIM.ApprovedIncident.comment | str | Comments for incidents created by the rule. |
| QualysFIM.ApprovedIncident.username | str | Name of the user who created this incident. |
| QualysFIM.ApprovedIncident.status | str | Incident status. |
| QualysFIM.ApprovedIncident.reviewers | str | List of reviewers who will approve the incident. |
Command Example
!qualys-fim-incident-approve incident_id=8af30349-bd07-4c0d-8469-58d9d7218ffa approval_status=APPROVED change_type=AUTOMATED comment=approved disposition_category=MALWARE
Context Example
{
"QualysFIM": {
"Incident": {
"approvalDate": "2021-02-16T09:52:49.985+0000",
"approvalStatus": "APPROVED",
"approvalType": "MANUAL",
"assignDate": "2021-02-16T09:46:44.769+0000",
"changeType": "AUTOMATED",
"comment": "approved",
"createdById": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"createdByName": "Qmasters",
"createdDate": "2021-02-16T09:46:44.768+0000",
"customerId": "12345678999",
"deleted": false,
"dispositionCategory": "MALWARE",
"filterFromDate": "2021-01-01T00:00:00.000+0000",
"filterToDate": "2021-02-15T00:00:00.000+0000",
"filterUpdatedDate": "2021-02-16T09:46:44.768+0000",
"filters": [
"dateTime: ['2021-01-01'..'2021-02-15']"
],
"id": "8af30349-bd07-4c0d-8469-58d9d7218ffa",
"lastUpdatedById": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"lastUpdatedByName": "Qmasters",
"lastUpdatedDate": "2021-02-16T09:46:44.768+0000",
"marked": false,
"markupStatus": null,
"moved": null,
"name": "testtest",
"reviewers": [
"useruser"
],
"ruleId": null,
"ruleName": null,
"status": "CLOSED",
"type": "DEFAULT"
}
}
}
Human Readable Output
Approved Incident: testtest
id name type filterFromDate filterToDate filters approvalDate approvalStatus approvalType comment createdByName status reviewers dispositionCategory changeType 8af30349-bd07-4c0d-8469-58d9d7218ffa testtest DEFAULT 2021-01-01 00:00:00 2021-02-15 00:00:00 dateTime: [‘2021-01-01’..’2021-02-15’] 2021-02-16 09:52:49 APPROVED MANUAL approved Qmasters CLOSED useruser MALWARE AUTOMATED
qualys-fim-assets-list
Retrieve a list of all FIM assets.
Base Command
qualys-fim-assets-list
Input
| Argument Name | Description | Required |
|---|---|---|
| attributes | The list of comma-separated attributes that you want to include in the response. By default, all attributes will be returned in the result. i.e: attributes=”attributes=interfaces.hostname”. | Optional |
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Assets.hostname | str | Asset hostname. |
| QualysFIM.Assets.lastCheckedIn | str | Date the asset was last checked. |
| QualysFIM.Assets.created | str | Date the asset was created. |
Command Example
!qualys-fim-assets-list limit=3
Context Example
{
"QualysFIM": {
"Asset": [
{
"activationDate": 1610279920980,
"agentService": {
"driverVersion": "4.1.0.744",
"httpStatus": null,
"osStatus": null,
"status": "FIM_EVENTS_UPLOADED",
"statusCode": 2007,
"updatedDate": 1613467885762
},
"agentUuid": "b1caea93-0d21-4343-801c-92009f036c79",
"agentVersion": "1.1.1.1",
"assetId": 20032549,
"created": 1610279920980,
"customerId": 524090,
"customerUuid": "12345678999",
"ec2": null,
"hostId": 15855913,
"id": "b1caea93-0d21-4343-801c-92009f036c79",
"interfaces": [
{
"address": "10.0.0.12",
"hostname": "Qmasters_desktop",
"interfaceName": "Intel(R) Dual Band Wireless-AC 8265",
"macAddress": "04:33:C2:64:45:B5"
},
{
"address": "1.1.1.1",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter #2",
"macAddress": "00:15:5D:8E:77:64"
},
{
"address": "1.1.1.1",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter",
"macAddress": "00:15:5D:74:86:60"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter #2",
"macAddress": "00:15:5D:8E:77:64"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter",
"macAddress": "00:15:5D:74:86:60"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": "Qmasters_desktop",
"interfaceName": "Intel(R) Dual Band Wireless-AC 8265",
"macAddress": "04:33:C2:64:45:B5"
}
],
"lastCheckedIn": 1613463519000,
"lastLoggedOnUser": ".\\Qmasters",
"manifest": {
"id": "4bca8be5-4b84-473c-998d-16fbcbd08761",
"status": "FIM_MANIFEST_ASSIGNED",
"updatedDate": 1610978060927
},
"name": "Qmasters_desktop",
"netbiosName": "Qmasters_desktop",
"operatingSystem": "Microsoft Windows 10 Pro 10.0.18363 64-bit N/A Build 18363",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610279901826,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "810dbed0-7314-4531-b7a0-7f2733f1be10",
"name": "qmasters_02",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895239253,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "ca93db3b-6e8a-4b22-b394-c436caf5f7cd",
"name": "Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895240533,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "53f22775-6ea6-4bde-a2e4-ade0b8754a6c",
"name": "Monitoring Profile for Oracle Database on Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895241659,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "142a5071-183d-4359-a7dd-e6b3a766c1ad",
"name": "Lightweight Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610226039643,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "b5ff2d41-1c38-4c5f-bdf9-d94dee15b027",
"name": "Qmasters",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610894881272,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
}
],
"system": {
"lastBoot": 1613463519000
},
"tags": [
"fde350b6-c5c3-4764-8060-185269d93109",
"89bec2e4-9046-44b4-ba35-6098af65aca2"
]
},
{
"activationDate": 1610899301086,
"agentService": {
"driverVersion": "1.1.1.1",
"httpStatus": null,
"osStatus": null,
"status": "FIM_EVENTS_UPLOADED",
"statusCode": 2007,
"updatedDate": 1610900638754
},
"agentUuid": "12345678",
"agentVersion": "4.0.0.411",
"assetId": 20234688,
"created": 1610899301086,
"customerId": 524090,
"customerUuid": "12345678999",
"ec2": null,
"hostId": 15994867,
"id": "12345678",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": 1610900217057,
"lastLoggedOnUser": "QMASTERS",
"manifest": {
"id": "3aff4a9e-d8f0-4df2-b345-74d05b9a3200",
"status": "FIM_MANIFEST_ASSIGNED",
"updatedDate": 1610900110706
},
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895239253,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "ca93db3b-6e8a-4b22-b394-c436caf5f7cd",
"name": "Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610894881272,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610279901826,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "810dbed0-7314-4531-b7a0-7f2733f1be10",
"name": "qmasters_02",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
}
],
"system": {
"lastBoot": 1610900217057
},
"tags": [
"fde350b6-c5c3-4764-8060-185269d93109"
]
}
]
}
}
Human Readable Output
Listed 2 Assets
Hostname Last Activity Creation Time Agent Version Driver Version Last Agent Update Asset ID Qmasters_desktop 2021-02-16 08:18:39 2021-01-10 11:58:40 1.1.1.1 4.1.0.744 2021-02-16 09:31:25 b1caea93-0d21-4343-801c-92009f036c79 DC 2021-01-17 16:16:57 2021-01-17 16:01:41 4.0.0.411 1.1.1.1 2021-01-17 16:23:58 12345678
Configuration parameters
credentials— Username (required)platform— Qualys API Platform URL (required)isFetch— Fetch incidentsfirst_fetch— Fetch timeincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalmax_fetch— Max Fetchfetch_filter— Fetch Filterinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (7)
-
qualys-fim-assets-listRetrieve a list of all FIM assets.
-
qualys-fim-event-getRetrieve information about a given event, by event ID.
-
qualys-fim-events-listRetrieve a list of all FIM events from the current user account.
-
qualys-fim-incident-approveMark an existing FIM incident as approved.
-
qualys-fim-incident-createCreate a manual FIM incident of type "DEFAULT".
-
qualys-fim-incidents-get-eventsRetrieve a list of the events logged under an incident.
-
qualys-fim-incidents-listRetrieve a list of all FIM incidents from the current user account.
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 import urllib3 from CommonServerUserPython import * """ IMPORTS """ import json import dateparser # Disable insecure warnings urllib3.disable_warnings() """ CONSTANTS """ DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.%fZ" DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%S.%f+0000" TABLE_DATETIME_FORMAT = "%Y-%m-%d %H:%M:%S" SORT_DICTIONARY = {"most_recent": "desc", "least_recent": "asc"} class Client(BaseClient): """ API Client to communicate with QualysFIM. """ def __init__(self, base_url: str, verify: bool, proxy: bool, auth: tuple): super().__init__(base_url=base_url, verify=verify, proxy=proxy) self._headers = self.get_token_and_set_headers(auth) def get_token_and_set_headers(self, auth: tuple) -> dict: """ Get JWT token by authentication and set headers. Args: auth (tuple): credentials for authentication. Returns: headers with token. Raises: DemistoException if authentication request was not successful. """ try: data = {"username": auth[0], "password": auth[1], "token": True} headers = {"ContentType": "application/x-www-form-urlencoded"} token = self._http_request( method="POST", url_suffix="/auth", headers=headers, data=data, resp_type="text", raise_on_status=True, ) return {"Authorization": f"Bearer {token}", "content-type": "application/json"} except Exception as e: raise DemistoException( "Authentication failed. Verify the Qualys API Platform URL, " "access credentials, and other connection parameters." ) from e def incidents_list_test(self): """ List 1 Incident for "test_module". return: response (Response): API response from Qualys FIM. """ return self.incidents_list(data={"pageSize": "1"}) def events_list(self, data: dict): """ List all logged events. Args: data (dict): dictionary of parameters for API call. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix="fim/v2/events/search", json_data=data) def get_event(self, event_id: str): """ Get a single event based on ID. Args: event_id (str): ID of the event to get. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="GET", url_suffix=f"fim/v2/events/{event_id}") def incidents_list(self, data: dict): """ List all Incidents. Args: data (dict): dictionary of parameters for API call. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix="fim/v3/incidents/search", json_data=data) def get_incident_events(self, incident_id: str, data: dict): """ Get all events from single incident based on incident ID. Args: incident_id (str): ID of the incident's events to get. data (dict): dictionary of parameters for API call. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix=f"fim/v2/incidents/{incident_id}/events/search", json_data=data) def assets_list(self, params: dict): """ list all assets. Args: params (dict): dictionary of parameters for API call. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix="fim/v3/assets/search", json_data=params) def create_incident(self, data: dict): """ Create new incident. Args: data (dict): dictionary with incident creation data. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix="fim/v3/incidents/create", json_data=data) def approve_incident(self, incident_id: str, data: dict): """ Approve incident based on ID. Args: incident_id (str): ID of the incident to approve. data (dict): dictionary with approval data for the approval request. return: response (Dict): API response from Qualys FIM. """ return self._http_request(method="POST", url_suffix=f"fim/v3/incidents/{incident_id}/approve", json_data=data) def create_event_or_incident_output(item: Dict, table_headers: List[str]) -> Dict[str, str]: """ Create the complete output dictionary for events or incidents. Args: item (dict): A source dictionary from the API response. table_headers (list(str)): The table headers to be used when creating initial data. Returns: object_data (dict[str,str]): The output dictionary. """ alert_data = {field: item.get(field) for field in table_headers} if "agentId" in table_headers: alert_data["agentId"] = dict_safe_get(item, ["asset", "agentId"]) if "username" in table_headers: alert_data["occurred"] = dict_safe_get(item, ["createdBy", "date"]) alert_data["username"] = dict_safe_get(item, ["createdBy", "user", "name"]) if "profiles" in table_headers: profiles = item.get("profiles", []) profiles_list = [] for profile in profiles: name = profile.get("name") if name is not None: profiles_list.append(name) alert_data["profiles"] = profiles_list return remove_empty_elements(alert_data) def list_events_command(client: Client, args: dict): """ List all relevant events. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ sort = json.dumps([{"dateTime": SORT_DICTIONARY.get(str(args["sort"]))}]) params = remove_empty_elements( { "filter": args.get("filter"), "pageNumber": args.get("page_number", "0"), "pageSize": args.get("limit", "10"), "incidentIds": argToList(args.get("incident_ids")), "sort": sort, } ) raw_response = client.events_list(params) table_headers = ["id", "severity", "dateTime", "agentId", "fullPath"] outputs = [] raw_outputs = [] if raw_response: for item in raw_response: data = item.get("data") raw_outputs.append(data) item_dictionary = create_event_or_incident_output(data, table_headers) date_time = item_dictionary.get("dateTime") if date_time: item_dictionary["dateTime"] = datetime.strptime(date_time, DATETIME_FORMAT).strftime(TABLE_DATETIME_FORMAT) outputs.append(item_dictionary) readable_output = tableToMarkdown(name=f"Listed {len(outputs)} Events:", t=outputs, headers=table_headers, removeNull=True) return CommandResults( outputs_prefix="QualysFIM.Event", outputs_key_field="id", raw_response=raw_response, outputs=raw_outputs, readable_output=readable_output, ) def get_event_command(client: Client, args: dict): """ Get a specific event by ID. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ raw_response = client.get_event(str(args["event_id"])) table_headers = ["name", "action", "id", "severity", "action", "incidentId", "profiles", "type", "dateTime", "fullPath"] object_data = create_event_or_incident_output(raw_response, table_headers) object_data["dateTime"] = datetime.strptime(str(object_data.get("dateTime")), DATETIME_FORMAT).strftime(TABLE_DATETIME_FORMAT) readable_output = tableToMarkdown(name="Found Event:", t=object_data, headers=table_headers, removeNull=True) return CommandResults( outputs_prefix="QualysFIM.Event", outputs_key_field="id", raw_response=raw_response, outputs=raw_response, readable_output=readable_output, ) def list_incidents_command(client: Client, args: dict): """ List all relevant incidents. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ sort = json.dumps([{"dateTime": SORT_DICTIONARY.get(str(args["sort"]))}]) params = remove_empty_elements( { "filter": args.get("filter"), "pageNumber": args.get("page_number", "0"), "pageSize": args.get("limit", "10"), "attributes": args.get("attributes"), "sort": sort, } ) raw_response = client.incidents_list(params) table_headers = [ "id", "name", "type", "username", "status", "occurred", "approvalStatus", "approvalType", "comment", "dispositionCategory", ] outputs = [] raw_outputs = [] if raw_response: for item in raw_response: data = item.get("data") raw_outputs.append(data) item_dictionary = create_event_or_incident_output(data, table_headers) occurred = item_dictionary.get("occurred") if occurred: item_dictionary["occurred"] = epochToTimestamp(occurred) outputs.append(item_dictionary) readable_output = tableToMarkdown(name=f"Listed {len(outputs)} Incidents:", t=outputs, headers=table_headers, removeNull=True) return CommandResults( outputs_prefix="QualysFIM.Incident", outputs_key_field="id", raw_response=raw_response, outputs=raw_outputs, readable_output=readable_output, ) def list_incident_events_command(client: Client, args: dict): """ Get a specific incident's events by incident ID. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ params = remove_empty_elements( { "filter": args.get("filter"), "pageNumber": args.get("page_number", "0"), "pageSize": args["limit"], "attributes": args.get("attributes"), } ) raw_response = client.get_incident_events(str(args.get("incident_id")), params) table_headers = ["id", "name", "severity", "action", "type", "dateTime"] outputs = [] raw_outputs = [] if raw_response: for item in raw_response: data = item.get("data") if data: raw_outputs.append(data) item_dictionary = create_event_or_incident_output(data, table_headers) date_time = item_dictionary.get("dateTime") if date_time: date_time = datetime.strptime(date_time, DATETIME_FORMAT).strftime(TABLE_DATETIME_FORMAT) item_dictionary["dateTime"] = date_time outputs.append(item_dictionary) readable_output = tableToMarkdown( name=f"Listed {len(outputs)} Events From Incident:", t=outputs, headers=table_headers, removeNull=True ) return CommandResults( outputs_prefix="QualysFIM.Event", outputs_key_field="id", raw_response=raw_response, outputs=raw_outputs, readable_output=readable_output, ) def create_incident_command(client: Client, args: dict): """ Create a new incident. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ if len(str(args.get("name"))) > 128: raise ValueError("Name is limited to 128 characters, please shorten name.") if args.get("filters"): filters = args.get("filters") else: if args.get("from_date") and args.get("to_date"): filters = f"dateTime: ['{args.get('from_date')}'..'{args.get('to_date')}']" else: yesterday = (datetime.today() - timedelta(days=1)).strftime(DATETIME_FORMAT) today = datetime.today().strftime(DATETIME_FORMAT) filters = f"dateTime: ['{yesterday}'..'{today}']" data = remove_empty_elements( { "name": args["name"], "type": "DEFAULT", "filters": [filters], "comment": args.get("comment"), "reviewers": argToList(args.get("reviewers")), } ) created = client.create_incident(data) raw_response = client.incidents_list({"filter": f'id:{created.get("id")}'}) raw_response = raw_response[0].get("data") table_headers = ["id", "name", "reviewers", "username", "occurred", "filters", "approvalType"] output = create_event_or_incident_output(raw_response, table_headers) username = dict_safe_get(raw_response, ["userInfo", "user", "name"]) if username: output.update({"username": username}) occurred = dict_safe_get(raw_response, ["userInfo", "date"]) if occurred: output.update({"occurred": epochToTimestamp(occurred)}) readable_output = tableToMarkdown( name=f'Created New Incident: {raw_response.get("name")}', t=output, headers=table_headers, removeNull=True ) return CommandResults( outputs_prefix="QualysFIM.Incident", outputs_key_field="id", raw_response=raw_response, outputs=raw_response, readable_output=readable_output, ) def approve_incident_command(client: Client, args: dict): """ Approve incident based on ID. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ data = { "approvalStatus": args["approval_status"], "changeType": args["change_type"], "comment": args["comment"], "dispositionCategory": args["disposition_category"], } raw_response = client.approve_incident(str(args.get("incident_id")), remove_empty_elements(data)) table_headers = [ "id", "name", "type", "filterFromDate", "filterToDate", "filters", "approvalDate", "approvalStatus", "approvalType", "comment", "createdByName", "status", "reviewers", "dispositionCategory", "changeType", ] if raw_response: output = create_event_or_incident_output(raw_response, table_headers) output["approvalDate"] = datetime.strptime(str(output.get("approvalDate")), DATETIME_FORMAT).strftime( TABLE_DATETIME_FORMAT ) output["filterFromDate"] = datetime.strptime(str(output.get("filterFromDate")), DATETIME_FORMAT).strftime( TABLE_DATETIME_FORMAT ) output["filterToDate"] = datetime.strptime(str(output.get("filterToDate")), DATETIME_FORMAT).strftime( TABLE_DATETIME_FORMAT ) else: raise ValueError(f"Incident {args.get('incident_id')} wasn't found") readable_output = tableToMarkdown( name=f'Approved Incident: {raw_response.get("name", "unknown")}', t=output, headers=table_headers, removeNull=True ) return CommandResults( outputs_prefix="QualysFIM.Incident", outputs_key_field="id", raw_response=raw_response, outputs=raw_response, readable_output=readable_output, ) def list_assets_command(client: Client, args: dict): """ List all relevant assets. Args: client (Client): Qualys FIM API client. args (dict): All command arguments. Returns: CommandResults: outputs, readable outputs and raw response for XSOAR. """ params = remove_empty_elements( { "filter": args.get("filter"), "pageNumber": args.get("page_number", "0"), "pageSize": args.get("limit"), "attributes": args.get("attributes"), } ) raw_response = client.assets_list(params) table_headers = [ "Hostname", "Last Activity", "Creation Time", "Agent Version", "Driver Version", "Last Agent Update", "Asset ID", ] outputs = [] raw_outputs = [] if raw_response: for item in raw_response: asset_data = item.get("data") raw_outputs.append(asset_data) last_checked_in = asset_data.get("lastCheckedIn") if last_checked_in: last_checked_in = epochToTimestamp(last_checked_in) else: last_checked_in = None created = asset_data.get("created") if created: created = epochToTimestamp(created) else: created = None agent_version = asset_data.get("agentVersion") driver_version = dict_safe_get(asset_data, ["agentService", "driverVersion"]) asset_id = asset_data.get("id") agent_last_updated = dict_safe_get(asset_data, ["agentService", "updatedDate"]) if agent_last_updated: agent_last_updated = epochToTimestamp(agent_last_updated) hostname = None interfaces = asset_data.get("interfaces", []) for interface in interfaces: if interface.get("hostname") != "None": hostname = interface.get("hostname") break item_dictionary = remove_empty_elements( { "Hostname": hostname, "Last Activity": last_checked_in, "Creation Time": created, "Agent Version": agent_version, "Driver Version": driver_version, "Last Agent Update": agent_last_updated, "Asset ID": asset_id, } ) outputs.append(item_dictionary) readable_output = tableToMarkdown(name=f"Listed {len(outputs)} Assets:", t=outputs, headers=table_headers, removeNull=True) return CommandResults( outputs_prefix="QualysFIM.Asset", outputs_key_field="id", raw_response=raw_response, outputs=raw_outputs, readable_output=readable_output, ) def fetch_incidents( client: Client, last_run: Dict[str, int], max_fetch: str, fetch_filter: str | None, first_fetch_time: str ) -> tuple[Dict, List[dict]]: """ Fetch incidents (alerts) each minute (by default). Args: client (Client): QualysFIM Client. last_run (dict): Dict with last_fetch object, saving the last fetch time(in millisecond timestamp). max_fetch (str): Max number of alerts to fetch. fetch_filter (str | None): filter incidents with Qualys syntax. first_fetch_time (str): Dict with first fetch time in str (ex: 3 days ago). Returns: Tuple of next_run (millisecond timestamp) and the incidents list. """ demisto.debug(f"Starting fetch. Got {last_run=}.") last_incident_id = last_run.get("last_fetched_id") last_fetch_timestamp = last_run.get("last_fetch") if not last_fetch_timestamp: demisto.debug(f"Detected empty {last_fetch_timestamp=} (first fetch). Converting {first_fetch_time=}.") first_fetch_datetime = cast(datetime, dateparser.parse(first_fetch_time)) last_fetch_timestamp = int(first_fetch_datetime.timestamp() * 1000) else: last_fetch_timestamp = int(last_fetch_timestamp) if len(str(last_fetch_timestamp)) == 10: demisto.debug(f"Detected epoch in seconds of {last_fetch_timestamp=}, converting to milliseconds.") last_fetch_timestamp *= 1000 else: demisto.debug(f"Detected epoch in milliseconds of {last_fetch_timestamp=}, keeping as is.") time_now = int(datetime.timestamp(datetime.now()) * 1000) demisto.debug(f"Fetching from {last_fetch_timestamp=} to {time_now=} using {fetch_filter=} and {max_fetch=}.") if int(max_fetch) > 200: raise ValueError("Max Fetch is limited to 200 incidents per fetch, please choose lower number than 200.") params = { "pageSize": max_fetch, "filter": f"createdBy.date: ['{last_fetch_timestamp}'..'{time_now}']", "sort": '[{"createdBy.date":"asc"}]', } if fetch_filter: params["filter"] += f" and {fetch_filter}" demisto.debug(f"Sending API request with filter='{params['filter']}'.") raw_response = client.incidents_list(params) demisto.debug(f"API returned {len(raw_response)} raw incidents.") incidents = [] next_fetch_timestamp = last_fetch_timestamp for idx, incident in enumerate(raw_response): incident = incident.get("data", None) if not incident: demisto.debug(f"Incident {idx} has no 'data' field, skipping") continue incident_id = incident.get("id", None) if incident_id == last_incident_id: demisto.debug(f"Skipping duplicate {incident_id=}.") continue incident_name = incident.get("name", None) created_date = dict_safe_get(incident, ["createdBy", "date"]) if not created_date: demisto.debug(f"Incident {incident_id} missing createdBy.date, skipping") continue incident_created_time = datetime.fromtimestamp(created_date / 1000) incident = { "name": incident_name, "occurred": incident_created_time.strftime(DATE_FORMAT), "rawJSON": json.dumps(incident), "incident_id": incident_id, } incidents.append(incident) next_fetch_timestamp = max(created_date, next_fetch_timestamp) demisto.debug(f"Processed {len(incidents)} incidents after filtering.") if len(incidents) > 0: last_incident_id = incidents[-1].get("incident_id") demisto.debug(f"Setting {last_incident_id=}.") new_last_run = {"last_fetch": next_fetch_timestamp, "last_fetched_id": last_incident_id} demisto.debug(f"Setting {new_last_run=}.") return new_last_run, incidents def test_module(client: Client) -> str: """ Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful. Args: client: Qualys FIM client. Returns: 'ok' if test passed. Raises: DemistoException: If test failed (e.g. due to failed authentication). """ try: client.incidents_list_test() # raises exception if non-okay response return "ok" except Exception as e: if "Authorization" in str(e): DemistoException("Authentication wasn't successful,\n Please check credentials,\n or specify correct Platform URL.") raise def main(): """ PARSE AND VALIDATE INTEGRATION PARAMS """ params = demisto.params() username = params.get("credentials").get("identifier") password = params.get("credentials").get("password") base_url = params.get("platform") verify_certificate = not params.get("insecure", False) first_fetch_time = params.get("first_fetch", "7 days").strip() proxy = params.get("proxy", False) command = demisto.command() LOG(f"Command being called is {command}") try: client = Client(base_url=base_url, verify=verify_certificate, auth=(username, password), proxy=proxy) commands = { "qualys-fim-events-list": list_events_command, "qualys-fim-event-get": get_event_command, "qualys-fim-incidents-list": list_incidents_command, "qualys-fim-incidents-get-events": list_incident_events_command, "qualys-fim-incident-create": create_incident_command, "qualys-fim-incident-approve": approve_incident_command, "qualys-fim-assets-list": list_assets_command, } if command == "test-module": return_results(test_module(client)) elif command == "fetch-incidents": next_run, incidents = fetch_incidents( client=client, last_run=demisto.getLastRun(), first_fetch_time=first_fetch_time, fetch_filter=params.get("fetch_filter"), max_fetch=params.get("max_fetch", 50), ) demisto.setLastRun(next_run) demisto.incidents(incidents) elif command in commands: return_results(commands[command](client, demisto.args())) except Exception as e: return_error(f"Failed to execute {command} command. Error: {str(e)}") if __name__ in ("__main__", "__builtin__", "builtins"): main()