Details
| ID | qualys_fim |
|---|---|
| Provider | Qualys |
| Category | IT Services |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Qualys FIM: File Integrity Monitoring
Log and track file changes across global IT systems.
This integration was integrated and tested with version 2.6.0.0-23 of qualys_fim
Configure qualys_fim in Cortex
| Parameter | Description | Required |
|---|---|---|
| Username | Username for authentication | True |
| Password | Password for authentication | True |
| Qualys API Platform URL | The Qualys API server URL that you should use for API requests depends on the platform where your account is located. Platforms and URLS: Qualys US Platform 1: https://gateway.qg1.apps.qualys.com Qualys US Platform 2: https://gateway.qg2.apps.qualys.com Qualys US Platform 3: https://gateway.qg3.apps.qualys.com Qualys EU Platform 1: https://gateway.qg1.apps.qualys.eu Qualys EU Platform 2: https://gateway.qg2.apps.qualys.eu Qualys India Platform 1: https://gateway.qg1.apps.qualys.in Qualys Private Cloud Platform(Custom Platform): https://gateway.<customer_base_url> | True |
| Fetch incidents | Fetch incidents | False |
| Fetch time | First fetch timestamp (<number> <time unit>) e.g., 12 hours, 7 days | False |
| Incident Type | Incident type | False |
| Max Fetch | Max Fetch is limited to 200 incidents per fetch. Choose a value lower than 200. | False |
| Fetch Filter | Filter the incidents fetching by providing a query using Qualys syntax i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm | False |
| Insecure | Trust any certificate (not secure) | False |
| Proxy | Use system proxy settings | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
qualys-fim-events-list
Retrieve a list of all FIM events from the current user account.
Base Command
qualys-fim-events-list
Input
| Argument Name | Description | Required |
|---|---|---|
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| incident_ids | Comma-separated list of incident IDs to be included while searching for events in incidents. | Optional |
| sort | The method by which to sort the requested events. Possible values: “most_recent” and “least_recent”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Events.id | str | Event ID. |
| QualysFIM.Events.fullPath | str | Full path of the event. |
| QualysFIM.Events.dateTime | str | Date/time the event occurred. |
| QualysFIM.Events.severity | int | Event severity. |
| QualysFIM.Events.agentId | str | Agent ID. |
Command Example
!qualys-fim-events-list limit=12 sort=least_recent filter=severity:4
Context Example
{
"QualysFIM": {
"Event": [
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 320,
"userID": "1-2-3-4",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "User",
"name": "DC.user.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:16:57.843+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\LogFiles\\Sum\\Svc.log",
"id": "de361739-a082-3240-8459-786b8ed5fa3b",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Svc.log",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "",
"process": "",
"processID": 4,
"userID": "1-2-3-4",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:17:02.606+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\SOFTWARE.LOG2",
"id": "a123456",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "SOFTWARE.LOG2",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 400,
"userID": "S-1-5-19",
"userName": "nt authority\\local service"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:17:52.405+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-Known Folders API Service.evtx",
"id": "366b1576-57f2-335f-9929-3026f5111767",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Microsoft-Windows-Known Folders API Service.evtx",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.792+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.743+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"id": "ea119f31-162a-3d0c-b2f7-01b32b6bc015",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"id": "16aff3b1-6198-3996-bfb7-ee99cd3bbe2d",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.796+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"id": "8c96931f-db80-3e47-a79a-a0585ec77037",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:57.276+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"id": "421c080f-ebae-35ca-8ad4-19ac62554a0c",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.785+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"id": "0cf60a82-b006-385a-ba14-f666733a063b",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.752+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"id": "0e5d5385-8dac-31a8-846c-29755c73cf88",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.785+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.768+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"id": "68047fa3-8f25-3063-bce8-0b988b87190c",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:57.276+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Create",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf\\TiWorker.exe",
"process": "TiWorker.exe",
"processID": 1592,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": [
2
],
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:20.768+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"id": "5d6084f2-3a47-3c71-8131-ebd2f1d7c684",
"incidentId": "778c1168-bc37-476a-aff8-3eadcd2489e9",
"name": "COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.790+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
},
{
"action": "Attributes",
"actor": {
"imagePath": "",
"process": "",
"processID": 4,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:18:46.955+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\config\\SOFTWARE.LOG2",
"id": "2e84bdd4-5395-3549-a29f-548e3aca0e83",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "SOFTWARE.LOG2",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:23:59.023+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
}
]
}
}
Human Readable Output
Listed 12 Events
id severity dateTime agentId fullPath de361739-a082-3240-8459-786b8ed5fa3b 4 2021-01-17 16:16:57 12345678 \Device\HarddiskVolume2\Windows\System32\LogFiles\Sum\Svc.log a123456 4 2021-01-17 16:17:02 12345678 \Device\HarddiskVolume2\Windows\System32\config\SOFTWARE.LOG2 366b1576-57f2-335f-9929-3026f5111767 4 2021-01-17 16:17:52 12345678 \Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx ea119f31-162a-3d0c-b2f7-01b32b6bc015 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf 16aff3b1-6198-3996-bfb7-ee99cd3bbe2d 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms 8c96931f-db80-3e47-a79a-a0585ec77037 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.blf 421c080f-ebae-35ca-8ad4-19ac62554a0c 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.0.regtrans-ms 0cf60a82-b006-385a-ba14-f666733a063b 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms 0e5d5385-8dac-31a8-846c-29755c73cf88 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.1.regtrans-ms 68047fa3-8f25-3063-bce8-0b988b87190c 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms 5d6084f2-3a47-3c71-8131-ebd2f1d7c684 4 2021-01-17 16:18:20 12345678 \Device\HarddiskVolume2\Windows\System32\config\COMPONENTS{b30b23f5-4b70-11e6-80e6-e41d2d18dfd0}.TxR.2.regtrans-ms 2e84bdd4-5395-3549-a29f-548e3aca0e83 4 2021-01-17 16:18:46 12345678 \Device\HarddiskVolume2\Windows\System32\config\SOFTWARE.LOG2
qualys-fim-event-get
Retrieve information about a given event, by event ID.
Base Command
qualys-fim-event-get
Input
| Argument Name | Description | Required |
|---|---|---|
| event_id | ID of the event to retrieve information about. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Event.id | str | Event ID. |
| QualysFIM.Event.fullPath | str | Full path of the event. |
| QualysFIM.Event.dateTime | str | Date/time the event occurred. |
| QualysFIM.Event.name | str | Event name. |
| QualysFIM.Event.severity | int | Event severity. |
| QualysFIM.Event.action | str | Event action. |
| QualysFIM.Event.incidentId | str | Event ID. |
| QualysFIM.Event.profiles | str | List of all monitoring profiles name. |
Command Example
!qualys-fim-event-get event_id=de361739-a082-3240-8459-786b8ed5fa3b
Context Example
{
"QualysFIM": {
"Event": {
"action": "Content",
"actor": {
"imagePath": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe",
"process": "svchost.exe",
"processID": 320,
"userID": "S-1-5-18",
"userName": "nt authority\\system"
},
"asset": {
"agentId": "12345678",
"agentVersion": "4.0.0.411",
"assetType": "HOST",
"created": "2021-01-17T16:01:41.086+0000",
"ec2": null,
"hostId": "15994867",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": "2021-01-17T16:16:57.057Z",
"lastLoggedOnUser": "QMASTERS",
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"system": {
"lastBoot": "2021-01-17T16:16:57.057Z"
},
"tags": [
"78721806"
],
"updated": "2021-01-17T16:01:41.086+0000"
},
"changedAttributes": null,
"class": "Disk",
"customerId": "12345678999",
"dateTime": "2021-01-17T16:16:57.843+0000",
"fullPath": "\\Device\\HarddiskVolume2\\Windows\\System32\\LogFiles\\Sum\\Svc.log",
"id": "de361739-a082-3240-8459-786b8ed5fa3b",
"incidentId": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Svc.log",
"newContent": null,
"oldContent": null,
"platform": "WINDOWS",
"processedTime": "2021-01-17T16:18:56.786+0000",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"rules": [
{
"description": "",
"id": "bd760834-5bce-41ab-9ab4-47d8da94a145",
"name": "System32",
"number": 1,
"section": null,
"severity": 4,
"type": "directory"
}
],
"type": "WINDOWS"
}
],
"severity": 4,
"type": "File"
}
}
}
Human Readable Output
Found Event
name action id severity action incidentId profiles type dateTime fullPath Svc.log Content de361739-a082-3240-8459-786b8ed5fa3b 4 Content 4710aa44-8d69-4c00-8013-737768cb54be test_01 File 2021-01-17 16:16:57 \Device\HarddiskVolume2\Windows\System32\LogFiles\Sum\Svc.log
qualys-fim-incidents-list
Retrieve a list of all FIM incidents from the current user account.
Base Command
qualys-fim-incidents-list
Input
| Argument Name | Description | Required |
|---|---|---|
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| attributes | Comma-separated list of attributes to include in the response. By default, all attributes will be returned in the result, i.e., attributes=”attributes=name,id”. | Optional |
| sort | The method by which to sort the requested events. Possible values: “most_recent” and “least_recent”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Incidents.id | str | Incident ID. |
| QualysFIM.Incidents.name | str | Incident name. |
| QualysFIM.Incidents.type | str | Incident type. |
| QualysFIM.Incidents.occurred | str | Indicates when the incident was created. |
| QualysFIM.Incidents.username | str | Name of the user who created this incident. |
| QualysFIM.Incidents.status | str | Incident status. |
Command Example
!qualys-fim-incidents-list sort=least_recent limit=15 attributes=name,status,id filter=status:closed
Context Example
{
"QualysFIM": {
"Incident": [
{
"id": "4710aa44-8d69-4c00-8013-737768cb54be",
"name": "Deletion of Log Files",
"status": "CLOSED"
},
{
"id": "179e5d4e-1153-4d12-9980-4807b78fee62",
"name": "test700",
"status": "CLOSED"
},
{
"id": "b53eac81-902a-4c38-aee0-11f3b62d92fb",
"name": "w2www",
"status": "CLOSED"
},
{
"id": "b1f8c69b-e6ff-4470-8cf1-b37bd793d90d",
"name": "ppp3",
"status": "CLOSED"
},
{
"id": "b576c51b-480a-44d2-a19e-98b2c6cda4af",
"name": "www",
"status": "CLOSED"
},
{
"id": "497ab672-c65b-42c1-a913-8c62a8262cce",
"name": "rrr",
"status": "CLOSED"
},
{
"id": "7b182a08-413e-4777-9493-9a23eb8c7e9e",
"name": "testtest2",
"status": "CLOSED"
},
{
"id": "2ebf1510-2fa3-4e53-9475-a9377cb81673",
"name": "test_incident_31",
"status": "CLOSED"
},
{
"id": "61c90caf-ea98-45eb-82db-469a27105e91",
"name": "test 15",
"status": "CLOSED"
},
{
"id": "7b63aed9-b849-4c49-8b33-b6bf56bcfc79",
"name": "ppp",
"status": "CLOSED"
},
{
"id": "d223968d-fa86-43c2-b7d6-4de0e2100a0d",
"name": "777",
"status": "CLOSED"
},
{
"id": "2ad82774-d6e9-4e33-913c-d6a1729530e0",
"name": "ll2",
"status": "CLOSED"
},
{
"id": "c5815a31-508b-469e-8990-e81ce2c6f33e",
"name": "testtest1",
"status": "CLOSED"
},
{
"id": "b6997b4d-8451-438b-9333-0f1ec81b870c",
"name": "test100",
"status": "CLOSED"
},
{
"id": "a9be84fd-5a7f-45b1-9f69-b1507ab2b218",
"name": "wwww",
"status": "CLOSED"
}
]
}
}
Human Readable Output
Listed 15 Incidents
id name status 4710aa44-8d69-4c00-8013-737768cb54be Deletion of Log Files CLOSED 179e5d4e-1153-4d12-9980-4807b78fee62 test700 CLOSED b53eac81-902a-4c38-aee0-11f3b62d92fb w2www CLOSED b1f8c69b-e6ff-4470-8cf1-b37bd793d90d ppp3 CLOSED b576c51b-480a-44d2-a19e-98b2c6cda4af www CLOSED 497ab672-c65b-42c1-a913-8c62a8262cce rrr CLOSED 7b182a08-413e-4777-9493-9a23eb8c7e9e testtest2 CLOSED 2ebf1510-2fa3-4e53-9475-a9377cb81673 test_incident_31 CLOSED 61c90caf-ea98-45eb-82db-469a27105e91 test 15 CLOSED 7b63aed9-b849-4c49-8b33-b6bf56bcfc79 ppp CLOSED d223968d-fa86-43c2-b7d6-4de0e2100a0d 777 CLOSED 2ad82774-d6e9-4e33-913c-d6a1729530e0 ll2 CLOSED c5815a31-508b-469e-8990-e81ce2c6f33e testtest1 CLOSED b6997b4d-8451-438b-9333-0f1ec81b870c test100 CLOSED a9be84fd-5a7f-45b1-9f69-b1507ab2b218 wwww CLOSED
qualys-fim-incidents-get-events
Retrieve a list of the events logged under an incident.
Base Command
qualys-fim-incidents-get-events
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | ID of the incident to retrieve the events for. | Required |
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
| attributes | Comma-separated list of attributes to include in the response. By default, all attributes will be returned in the result, i.e., attributes=”attributes=name,id”. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.IncidentEvents.id | str | Event ID. |
| QualysFIM.IncidentEvents.name | str | Event name. |
| QualysFIM.IncidentEvents.severity | str | Event severity. |
| QualysFIM.IncidentEvents.type | str | Event type. |
| QualysFIM.IncidentEvents.occurred | str | Indicates when the event was created. |
| QualysFIM.IncidentEvents.username | str | Name of the user who created this incident. |
| QualysFIM.IncidentEvents.status | str | Incident status. |
| QualysFIM.IncidentEvents.action | str | Action that was taken that triggered the event creation. |
Command Example
!qualys-fim-incidents-get-events incident_id=4710aa44-8d69-4c00-8013-737768cb54be limit=7 attributes=id,name,type page_number=2 filter=action:create
Context Example
{
"QualysFIM": {
"Event": [
{
"id": "85873770-2c46-3c1c-94f6-a1fd117ca504",
"name": "8fe303d4743fc547b447af276bb19008",
"type": "File"
},
{
"id": "2e3ca9c5-354f-3f3d-a16b-c390b3b139d2",
"name": "6f3604d7c44b1b44b1addd026d40f547",
"type": "File"
},
{
"id": "cb8fd91a-5f0a-374e-9ccc-a1d762273322",
"name": "tw-4080-41f0-b2f98d.tmp",
"type": "File"
},
{
"id": "b267ddd7-308d-33f6-863e-fc85efaae6de",
"name": "SRUtmp.log",
"type": "File"
},
{
"id": "b129d76f-827f-3f1e-babb-e96fbfbdc697",
"name": "oem117.cat",
"type": "File"
},
{
"id": "87399be0-69fe-3881-85a1-b01ce1288672",
"name": "EtwRTTerminal-Services-LSM-ApplicationLag-6812.etl",
"type": "File"
},
{
"id": "0636da15-3c33-359f-9574-0bbc2d331e8a",
"name": "SRUtmp.log",
"type": "File"
}
]
}
}
Human Readable Output
Listed 7 Events From Incident
id name type 85873770-2c46-3c1c-94f6-a1fd117ca504 8fe303d4743fc547b447af276bb19008 File 2e3ca9c5-354f-3f3d-a16b-c390b3b139d2 6f3604d7c44b1b44b1addd026d40f547 File cb8fd91a-5f0a-374e-9ccc-a1d762273322 tw-4080-41f0-b2f98d.tmp File b267ddd7-308d-33f6-863e-fc85efaae6de SRUtmp.log File b129d76f-827f-3f1e-babb-e96fbfbdc697 oem117.cat File 87399be0-69fe-3881-85a1-b01ce1288672 EtwRTTerminal-Services-LSM-ApplicationLag-6812.etl File 0636da15-3c33-359f-9574-0bbc2d331e8a SRUtmp.log File
qualys-fim-incident-create
Create a manual FIM incident of type “DEFAULT”.
Base Command
qualys-fim-incident-create
Input
| Argument Name | Description | Required |
|---|---|---|
| from_date | Date from which to start the event search. Example format: yyyy-mm-dd, 2021-01-01. | Optional |
| to_date | Date at which to stop the event search. Example format: yyyy-mm-dd, 2021-02-30. | Optional |
| filters | Filter the events list by providing a query using Qualys syntax. i.e., “dateTime : [‘2021-01-01’..’2021-03-29’]. When you use this argument it will overwrite the “from_date” and “to_date” arguments. If you don’t use the filter, the query will include the events from the last 24 hours. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| name | The name of the incident. Must be less than 128 characters. | Required |
| reviewers | Reviewers who will approve the incident. | Optional |
| comment | Comments for approval of the incident. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.CreatedIncident.id | str | Incident ID. |
| QualysFIM.CreatedIncident.name | str | Incident name. |
| QualysFIM.CreatedIncident.occurred | str | Indicates when the incident was created. |
| QualysFIM.CreatedIncident.username | str | Name of the user who created the incident. |
| QualysFIM.CreatedIncident.status | str | Incident status. |
| QualysFIM.CreatedIncident.reviewers | str | List of reviewers who will approve the incident. |
Command Example
!qualys-fim-incident-create name=testtest7 comment=new_incident filters="dateTime: ['2021-01-01'..'2021-02-15']"
Context Example
{
"QualysFIM": {
"CreatedIncident": {
"approvalType": "MANUAL",
"customerId": "12345678999",
"filters": [
"dateTime: ['2021-01-01'..'2021-02-15']"
],
"id": "5f9f5504-46eb-4a30-b022-fd0dba7758eb",
"name": "testtest7",
"reviewers": [
"useruser"
],
"type": "DEFAULT",
"userInfo": {
"date": 1613469168294,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
}
}
}
}
Human Readable Output
Created New Incident: testtest7
id name reviewers username occurred filters approvalType 5f9f5504-46eb-4a30-b022-fd0dba7758eb testtest7 useruser Qmasters 2021-02-16 09:52:48 dateTime: [‘2021-01-01’..’2021-02-15’] MANUAL
qualys-fim-incident-approve
Mark an existing FIM incident as approved.
Base Command
qualys-fim-incident-approve
Input
| Argument Name | Description | Required |
|---|---|---|
| approval_status | The approval status of the incident. Possible values: “APPROVED”, “POLICY_VIOLATION”, “UNAPPROVED”. | Required |
| change_type | Type of incidents. Possible values: “MANUAL”, “AUTOMATED”, “COMPROMISE”, “OTHER”. | Required |
| comment | Comments for the incidents. | Required |
| incident_id | incident ID to approve. | Required |
| disposition_category | The category of the incident created by the rule. Possible values: “PATCHING”, “PRE_APPROVED_CHANGE_CONTROL”, “CONFIGURATION_CHANGE”, “HUMAN_ERROR”, “DATA_CORRUPTION”, “EMERGENCY_CHANGE”, “CHANGE_CONTROL_VIOLATION”, “GENERAL_HACKING”, “MALWARE”. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.ApprovedIncident.id | str | Incident ID. |
| QualysFIM.ApprovedIncident.name | str | Incident name. |
| QualysFIM.ApprovedIncident.type | str | Incident type. |
| QualysFIM.ApprovedIncident.filterFromDate | str | The date from which to filter the approved incident. |
| QualysFIM.ApprovedIncident.filterToDate | str | The date until when to filter the approved incident. |
| QualysFIM.ApprovedIncident.approvalDate | str | Approval date of the incident. |
| QualysFIM.ApprovedIncident.approvalStatus | str | Approval status of the incident. |
| QualysFIM.ApprovedIncident.comment | str | Comments for incidents created by the rule. |
| QualysFIM.ApprovedIncident.username | str | Name of the user who created this incident. |
| QualysFIM.ApprovedIncident.status | str | Incident status. |
| QualysFIM.ApprovedIncident.reviewers | str | List of reviewers who will approve the incident. |
Command Example
!qualys-fim-incident-approve incident_id=8af30349-bd07-4c0d-8469-58d9d7218ffa approval_status=APPROVED change_type=AUTOMATED comment=approved disposition_category=MALWARE
Context Example
{
"QualysFIM": {
"Incident": {
"approvalDate": "2021-02-16T09:52:49.985+0000",
"approvalStatus": "APPROVED",
"approvalType": "MANUAL",
"assignDate": "2021-02-16T09:46:44.769+0000",
"changeType": "AUTOMATED",
"comment": "approved",
"createdById": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"createdByName": "Qmasters",
"createdDate": "2021-02-16T09:46:44.768+0000",
"customerId": "12345678999",
"deleted": false,
"dispositionCategory": "MALWARE",
"filterFromDate": "2021-01-01T00:00:00.000+0000",
"filterToDate": "2021-02-15T00:00:00.000+0000",
"filterUpdatedDate": "2021-02-16T09:46:44.768+0000",
"filters": [
"dateTime: ['2021-01-01'..'2021-02-15']"
],
"id": "8af30349-bd07-4c0d-8469-58d9d7218ffa",
"lastUpdatedById": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"lastUpdatedByName": "Qmasters",
"lastUpdatedDate": "2021-02-16T09:46:44.768+0000",
"marked": false,
"markupStatus": null,
"moved": null,
"name": "testtest",
"reviewers": [
"useruser"
],
"ruleId": null,
"ruleName": null,
"status": "CLOSED",
"type": "DEFAULT"
}
}
}
Human Readable Output
Approved Incident: testtest
id name type filterFromDate filterToDate filters approvalDate approvalStatus approvalType comment createdByName status reviewers dispositionCategory changeType 8af30349-bd07-4c0d-8469-58d9d7218ffa testtest DEFAULT 2021-01-01 00:00:00 2021-02-15 00:00:00 dateTime: [‘2021-01-01’..’2021-02-15’] 2021-02-16 09:52:49 APPROVED MANUAL approved Qmasters CLOSED useruser MALWARE AUTOMATED
qualys-fim-assets-list
Retrieve a list of all FIM assets.
Base Command
qualys-fim-assets-list
Input
| Argument Name | Description | Required |
|---|---|---|
| attributes | The list of comma-separated attributes that you want to include in the response. By default, all attributes will be returned in the result. i.e: attributes=”attributes=interfaces.hostname”. | Optional |
| filter | Filter the events list by providing a query using Qualys syntax. i.e., “id:ebe6c64a-8b0d-3401-858d-d57fb25860c7”. Refer to the “How to Search” Qualys FIM guide for more information about Qualys syntax: https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm. | Optional |
| page_number | Page number (index) to list items from. The “limit” argument defines the page size (the number of items in a page). | Optional |
| limit | The number of records to include. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| QualysFIM.Assets.hostname | str | Asset hostname. |
| QualysFIM.Assets.lastCheckedIn | str | Date the asset was last checked. |
| QualysFIM.Assets.created | str | Date the asset was created. |
Command Example
!qualys-fim-assets-list limit=3
Context Example
{
"QualysFIM": {
"Asset": [
{
"activationDate": 1610279920980,
"agentService": {
"driverVersion": "4.1.0.744",
"httpStatus": null,
"osStatus": null,
"status": "FIM_EVENTS_UPLOADED",
"statusCode": 2007,
"updatedDate": 1613467885762
},
"agentUuid": "b1caea93-0d21-4343-801c-92009f036c79",
"agentVersion": "1.1.1.1",
"assetId": 20032549,
"created": 1610279920980,
"customerId": 524090,
"customerUuid": "12345678999",
"ec2": null,
"hostId": 15855913,
"id": "b1caea93-0d21-4343-801c-92009f036c79",
"interfaces": [
{
"address": "10.0.0.12",
"hostname": "Qmasters_desktop",
"interfaceName": "Intel(R) Dual Band Wireless-AC 8265",
"macAddress": "04:33:C2:64:45:B5"
},
{
"address": "1.1.1.1",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter #2",
"macAddress": "00:15:5D:8E:77:64"
},
{
"address": "1.1.1.1",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter",
"macAddress": "00:15:5D:74:86:60"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter #2",
"macAddress": "00:15:5D:8E:77:64"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": null,
"interfaceName": "Hyper-V Virtual Ethernet Adapter",
"macAddress": "00:15:5D:74:86:60"
},
{
"address": "aa00:0:0:0:00aa:0a00:a00a:00a0",
"hostname": "Qmasters_desktop",
"interfaceName": "Intel(R) Dual Band Wireless-AC 8265",
"macAddress": "04:33:C2:64:45:B5"
}
],
"lastCheckedIn": 1613463519000,
"lastLoggedOnUser": ".\\Qmasters",
"manifest": {
"id": "4bca8be5-4b84-473c-998d-16fbcbd08761",
"status": "FIM_MANIFEST_ASSIGNED",
"updatedDate": 1610978060927
},
"name": "Qmasters_desktop",
"netbiosName": "Qmasters_desktop",
"operatingSystem": "Microsoft Windows 10 Pro 10.0.18363 64-bit N/A Build 18363",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610279901826,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "810dbed0-7314-4531-b7a0-7f2733f1be10",
"name": "qmasters_02",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895239253,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "ca93db3b-6e8a-4b22-b394-c436caf5f7cd",
"name": "Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895240533,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "53f22775-6ea6-4bde-a2e4-ade0b8754a6c",
"name": "Monitoring Profile for Oracle Database on Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895241659,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "142a5071-183d-4359-a7dd-e6b3a766c1ad",
"name": "Lightweight Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610226039643,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "b5ff2d41-1c38-4c5f-bdf9-d94dee15b027",
"name": "Qmasters",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610894881272,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
}
],
"system": {
"lastBoot": 1613463519000
},
"tags": [
"fde350b6-c5c3-4764-8060-185269d93109",
"89bec2e4-9046-44b4-ba35-6098af65aca2"
]
},
{
"activationDate": 1610899301086,
"agentService": {
"driverVersion": "1.1.1.1",
"httpStatus": null,
"osStatus": null,
"status": "FIM_EVENTS_UPLOADED",
"statusCode": 2007,
"updatedDate": 1610900638754
},
"agentUuid": "12345678",
"agentVersion": "4.0.0.411",
"assetId": 20234688,
"created": 1610899301086,
"customerId": 524090,
"customerUuid": "12345678999",
"ec2": null,
"hostId": 15994867,
"id": "12345678",
"interfaces": [
{
"address": "8.8.8.8",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
},
{
"address": "fe00:0:0:0:00a0:a000:00dc:000b",
"hostname": "DC",
"interfaceName": "Intel(R) 82574L Gigabit Network Connection #2",
"macAddress": "00:0C:00:0B:A0:0E"
}
],
"lastCheckedIn": 1610900217057,
"lastLoggedOnUser": "QMASTERS",
"manifest": {
"id": "3aff4a9e-d8f0-4df2-b345-74d05b9a3200",
"status": "FIM_MANIFEST_ASSIGNED",
"updatedDate": 1610900110706
},
"name": "DC.qmasters.local",
"netbiosName": "DC",
"operatingSystem": "Microsoft Windows Server 2016 Standard Evaluation 10.0.14393 64-bit N/A Build 14393",
"profiles": [
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610895239253,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "ca93db3b-6e8a-4b22-b394-c436caf5f7cd",
"name": "Monitoring Profile for Windows",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "2.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610894881272,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "432b8f93-c610-4c8f-9e7d-6cdae41f2dc5",
"name": "test_01",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
},
{
"category": {
"id": "2dab5022-2fdd-11e7-93ae-92361f002671",
"name": "PCI"
},
"createdBy": {
"date": 1610279901826,
"user": {
"id": "1a7f00bd-cbde-7d97-831f-ba25de45c44e",
"name": "Qmasters"
}
},
"customerId": "12345678999",
"id": "810dbed0-7314-4531-b7a0-7f2733f1be10",
"name": "qmasters_02",
"osVersions": [],
"status": "ACTIVATED",
"type": "WINDOWS",
"version": "1.0"
}
],
"system": {
"lastBoot": 1610900217057
},
"tags": [
"fde350b6-c5c3-4764-8060-185269d93109"
]
}
]
}
}
Human Readable Output
Listed 2 Assets
Hostname Last Activity Creation Time Agent Version Driver Version Last Agent Update Asset ID Qmasters_desktop 2021-02-16 08:18:39 2021-01-10 11:58:40 1.1.1.1 4.1.0.744 2021-02-16 09:31:25 b1caea93-0d21-4343-801c-92009f036c79 DC 2021-01-17 16:16:57 2021-01-17 16:01:41 4.0.0.411 1.1.1.1 2021-01-17 16:23:58 12345678
Configuration parameters
credentials— Username (required)platform— Qualys API Platform URL (required)isFetch— Fetch incidentsfirst_fetch— Fetch timeincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalmax_fetch— Max Fetchfetch_filter— Fetch Filterinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (7)
-
qualys-fim-assets-listRetrieve a list of all FIM assets.
-
qualys-fim-event-getRetrieve information about a given event, by event ID.
-
qualys-fim-events-listRetrieve a list of all FIM events from the current user account.
-
qualys-fim-incident-approveMark an existing FIM incident as approved.
-
qualys-fim-incident-createCreate a manual FIM incident of type "DEFAULT".
-
qualys-fim-incidents-get-eventsRetrieve a list of the events logged under an incident.
-
qualys-fim-incidents-listRetrieve a list of all FIM incidents from the current user account.
import json from urllib.parse import urljoin import pytest from freezegun import freeze_time from QualysFIM import Client BASE_URL = "https://gateway.qg2.apps.qualys.eu/" USERNAME = "Foo" PASSWORD = "Bar" def util_load_json(path: str) -> dict: with open(path, encoding="utf-8") as file: return json.loads(file.read()) @pytest.fixture def authenticated_client(requests_mock) -> Client: """Fixture to create a QualysFIM.Client instance.""" auth_url = urljoin(BASE_URL, "/auth") requests_mock.post(auth_url, json={}) return Client(base_url=BASE_URL, verify=False, proxy=False, auth=(USERNAME, PASSWORD)) def test_get_token_and_set_headers(mocker, authenticated_client: Client) -> None: """ Given: - QualysFIM.Client and access credentials When: - Client.get_token_and_set_headers is called Assert: - Correct authentication request URL and JSON body """ # Set auth_request = mocker.patch.object(Client, "_http_request") # Arrange authenticated_client.get_token_and_set_headers((USERNAME, PASSWORD)) auth_request_kwargs: dict = auth_request.call_args.kwargs # Assert assert auth_request.call_count == 1 assert auth_request_kwargs["url_suffix"] == "/auth" assert auth_request_kwargs["data"] == {"username": USERNAME, "password": PASSWORD, "token": True} def test_list_events_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: List events. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - list_events_command is called. Then: - Ensure number of items is correct. - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import list_events_command # Set mock_response = util_load_json("test_data/list_events.json") requests_mock.post(f"{BASE_URL}fim/v2/events/search", json=mock_response) # Arrange result = list_events_command(authenticated_client, {"sort": "most_recent"}) # Assert assert result.outputs_prefix == "QualysFIM.Event" assert result.outputs_key_field == "id" assert result.raw_response == mock_response assert result.outputs == [incident["data"] for incident in mock_response] def test_get_event_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: List events. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - get_event_command is called. Then: - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import get_event_command # Set mock_response = util_load_json("test_data/get_event.json") requests_mock.get(f"{BASE_URL}fim/v2/events/123456", json=mock_response) # Arrange result = get_event_command(authenticated_client, {"event_id": "123456"}) # Assert assert result.outputs_prefix == "QualysFIM.Event" assert result.outputs_key_field == "id" assert result.raw_response == mock_response assert result.outputs == mock_response def test_list_incidents_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: List incidents Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - list_incidents_command is called. Then: - Ensure number of items is correct. - Ensure outputs prefix is correct. - Ensure a sample value from the API matches what is generated in the context. - Ensure outputs key fields is correct. """ from QualysFIM import list_incidents_command # Set mock_response = util_load_json("test_data/list_incidents.json") requests_mock.post(f"{BASE_URL}fim/v3/incidents/search", json=mock_response) # Arrange result = list_incidents_command(authenticated_client, {"sort": "most_recent"}) # Assert assert result.outputs_prefix == "QualysFIM.Incident" assert result.outputs_key_field == "id" assert len(result.raw_response) == len(mock_response) assert result.raw_response == mock_response assert result.outputs[0]["id"] == mock_response[0]["data"]["id"] assert result.outputs[1]["id"] == mock_response[1]["data"]["id"] assert result.outputs == [incident["data"] for incident in mock_response] def test_get_incident_events_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: List incident's events Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - list_incidents_events_command is called. Then: - Ensure number of items is correct. - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import list_incident_events_command # Set limit = 10 mock_response = util_load_json("test_data/get_incident_events.json") requests_mock.post(f"{BASE_URL}fim/v2/incidents/None/events/search", json=mock_response) # Arrange result = list_incident_events_command(authenticated_client, {"limit": str(limit)}) # Assert assert result.outputs_prefix == "QualysFIM.Event" assert result.outputs_key_field == "id" assert len(result.raw_response) == limit assert result.raw_response == mock_response assert result.outputs == [event["data"] for event in mock_response] def test_create_incident_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: Create Incident. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - create_incident_command is called. Then: - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import create_incident_command # Set create_incident_mock_response = util_load_json("test_data/create_incident.json") requests_mock.post(f"{BASE_URL}fim/v3/incidents/create", json=create_incident_mock_response) search_incidents_mock_response = util_load_json("test_data/list_incidents.json") requests_mock.post(f"{BASE_URL}fim/v3/incidents/search", json=search_incidents_mock_response) first_search_result = search_incidents_mock_response[0]["data"] # Arrange result = create_incident_command(authenticated_client, {"name": "test"}) # Assert assert result.outputs_prefix == "QualysFIM.Incident" assert result.outputs_key_field == "id" assert result.raw_response == first_search_result assert result.outputs == first_search_result def test_approve_incident_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: Approve Incident. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - approve_incident_command is called. Then: - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import approve_incident_command # Set mock_response = util_load_json("test_data/approve_incident.json") requests_mock.post(f"{BASE_URL}fim/v3/incidents/None/approve", json=mock_response) args = {"approval_status": "test", "change_type": "test", "comment": "test", "disposition_category": "test"} # Arrange result = approve_incident_command(authenticated_client, args) # Assert assert result.outputs_prefix == "QualysFIM.Incident" assert result.outputs_key_field == "id" assert result.raw_response == mock_response assert result.outputs == mock_response def test_list_assets_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: List Assets. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - list_assets_command is called. Then: - Ensure number of items is correct. - Ensure outputs prefix is correct. - Ensure outputs key fields is correct. """ from QualysFIM import list_assets_command mock_response = util_load_json("test_data/list_assets.json") requests_mock.post(f"{BASE_URL}fim/v3/assets/search", json=mock_response) result = list_assets_command(authenticated_client, {}) assert result.outputs_prefix == "QualysFIM.Asset" assert result.outputs_key_field == "id" assert len(result.outputs) == 2 assert result.raw_response == mock_response def test_fetch_incidents_command(requests_mock, authenticated_client: Client) -> None: """ Scenario: Fetch Incidents. Given: - User has provided valid credentials. - Headers and JWT token have been set. When: - fetch_incidents is called. Then: - Ensure a sample value from the API matches what is generated in the context. - Ensure occurred time is correct. """ from QualysFIM import fetch_incidents mock_response = util_load_json("test_data/fetch_incidents.json") requests_mock.post(f"{BASE_URL}fim/v3/incidents/search", json=mock_response) _, incidents = fetch_incidents( client=authenticated_client, last_run={}, fetch_filter="", first_fetch_time="3 days", max_fetch="2" ) raw_json = json.loads(incidents[0]["rawJSON"]) assert raw_json["id"] == "75539bfc-c0e7-4bcb-b55a-48065ef89ebe" assert raw_json["createdBy"]["date"] == 1613378492427 @pytest.mark.parametrize( "last_run, fetch_filter, expected_filter", [ pytest.param( {"last_fetch": 1613205600}, # 10 digits - seconds format None, "createdBy.date: ['1613205600000'..'1613469600000']", id="Seconds timestamp, empty filter", ), pytest.param( {"last_fetch": 1613205600}, # 10 digits - seconds format "status: OPEN", "createdBy.date: ['1613205600000'..'1613469600000'] and status: OPEN", id="Seconds timestamp, with filter", ), pytest.param( {"last_fetch": 1613205600000}, # 13 digits - milliseconds format None, "createdBy.date: ['1613205600000'..'1613469600000']", id="Milliseconds timestamp, empty filter", ), pytest.param( {"last_fetch": 1613205600000}, # 13 digits - milliseconds format "status: OPEN", "createdBy.date: ['1613205600000'..'1613469600000'] and status: OPEN", id="Milliseconds timestamp, with filter", ), ], ) @freeze_time("2021-02-16 10:00:00", tz_offset=0) def test_fetch_incidents_filter_construction( mocker, authenticated_client: Client, last_run: dict, fetch_filter: str | None, expected_filter: str ) -> None: """ Given: - last_run with timestamp in seconds (10 digits) or milliseconds (13 digits) - fetch_filter parameter (empty or with value) When: - fetch_incidents is called Then: - Assert the filter string sent to the API is correctly constructed with 13-digit millisecond timestamps - Assert backward compatibility: both seconds and milliseconds input formats produce correct output """ from QualysFIM import fetch_incidents # Mocking incidents_list to capture the params mock_incidents_list = mocker.patch.object(Client, "incidents_list", return_value=[]) # Act fetch_incidents( client=authenticated_client, last_run=last_run, fetch_filter=fetch_filter, first_fetch_time="3 days", max_fetch="50", ) # Assert assert mock_incidents_list.call_args.args[0]["filter"] == expected_filter def test_create_event_or_incident_output() -> None: """ Given: - A list of table headers and a QualysFIM API event When: - create_event_or_incident_output is called Then: - Assert correct output dictionary and no empty values """ from QualysFIM import create_event_or_incident_output # Set table_headers = ["id", "severity", "dateTime", "agentId", "fullPath"] raw_event: dict = util_load_json("test_data/get_event.json") # Arrange event_output = create_event_or_incident_output(raw_event, table_headers) # Assert assert "customerId" not in event_output assert event_output == { "id": raw_event["id"], "severity": raw_event["severity"], "dateTime": raw_event["dateTime"], "agentId": raw_event["asset"]["agentId"], "fullPath": raw_event["fullPath"], } # function calls remove_empty_elements assert all(value not in ({}, []) for value in event_output.values()), "One or more event values are empty"