Launch And Fetch Compliance Policy Report - Qualys

Launches a compliance policy report and then fetches the report when it's ready.

Qualys · 4 tasks · 12 inputs · 0 outputs

Details

IDLaunch And Fetch Compliance Policy Report - Qualys
From Version5.5.0
Tasks4

README

Launches a compliance policy report and then fetches the report when it’s ready.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

GenericPolling

Integrations

QualysV2

Scripts

This playbook does not use any scripts.

Commands

  • qualys-report-launch-compliance-policy
  • qualys-report-fetch

Playbook Inputs


Name Description Default Value Required
template_id The template ID of the report you want to launch. Can be found by running the qualys-report-template-list command.   Required
output_format One output format can be specified. When output_format=pdf is specified, the Secure PDF Distribution can be used.   Required
report_title A user-defined report title. The title can have a maximum of 128 characters. For a PCI compliance report, the report title is provided by Qualys and cannot be changed.   Optional
hide_header (Valid for CSV format report only). Specify hide_header=1 to omit the header information from the report. By default, this information is included.   Optional
recipient_group_id Specify users who will receive the email notification when the report is complete (i.e., supply a distribution group ID). Where do I find this ID? Log in to your Qualys account, go to Users > Distribution Groups and select Info for a group in the list.   Optional
pdf_password (Required for secure PDF distribution, Manager or Unit Manager only) Used for secure PDF report distribution when this feature is enabled in the user’s account (under Reports > Setup > Report Share). The password to be used for encryption.
- The password must have a minimum of 8 characters (ascii), and a maximum of 32 characters.
- The password must contain alpha and numeric characters.
- The password cannot match the password for the user’s Qualys account.
- The password must follow the password security guidelines defined for your subscription (under Users > Setup > Security)
  Optional
recipient_group Used for secure PDF distribution. The report recipients in the form of one or more distribution group names, as defined using the Qualys UI. Multiple distribution groups are comma separated. A maximum of 50 distribution groups may be entered.   Optional
ips (Optional for compliance report) For a compliance report (except a PCI report), specify the IPs/ranges you want to include in the report. Multiple IPs and/or ranges are comma separated.   Optional
asset_group_ids (Optional for compliance report) For a compliance report (except a PCI report), specify asset groups IDs which identify hosts to include in the report. Multiple asset group IDs are comma separated. Looking for asset group IDs? Use the asset_group_list.php function (in the API v1 User Guide).   Optional
policy_id Specifies the policy to run the report on. A valid policy ID must be entered.   Required
host_id In the policy report output, show only results for a single host instance. Specify the ID for the host to include in the report. A valid host ID must be entered.   Optional
instance_string Specifies a single instance on the selected host. The instance string may be “os” or a string like “oracle10:1:1521:ora10204u”.   Optional

Playbook Outputs


There are no outputs for this playbook.

Playbook Image


Launch And Fetch Compliance Policy Report - Qualys

Inputs

  • template_id — The template ID of the report you want to launch. Can be found by running the command qualys-report-template-list.
  • output_format — One output format can be specified. When output_format=pdf is specified, the Secure PDF Distribution can be used.
  • report_title — A user-defined report title. The title may have a maximum of 128 characters. For a PCI compliance report, the report title is provided by Qualys and cannot be changed.
  • hide_header — (Valid for CSV format report only). Specify hide_header=1 to omit the header information from the report. By default, this information is included.
  • recipient_group_id — Specify users who will receive the email notification when the report is complete (i.e., supply a distribution group ID). Where do I find this ID? Log in to your Qualys account, go to Users > Distribution Groups and select Info for a group in the list.
  • pdf_password — (Required for secure PDF distribution, Manager or Unit Manager only) Used for secure PDF report distribution when this feature is enabled in the user's account (under Reports > Setup > Report Share). The password to be used for encryption. - the password must have a minimum of 8 characters (ascii), and a maximum of 32 characters - the password must contain alpha and numeric characters - the password cannot match the password for the user’s Qualys account. - the password must follow the password security guidelines defined for your subscription (under Users > Setup > Security)
  • recipient_group — Used for secure PDF distribution. The report recipients in the form of one or more distribution group names, as defined using the Qualys UI. Multiple distribution groups are comma separated. A maximum of 50 distribution groups may be entered.
  • ips — (Optional for compliance report) For a compliance report (except a PCI report), specify the IPs/ranges you want to include in the report. Multiple IPs and/or ranges are comma separated.
  • asset_group_ids — (Optional for compliance report) For a compliance report (except a PCI report), specify asset groups IDs which identify hosts to include in the report. Multiple asset group IDs are comma separated. Looking for asset group IDs? Use the asset_group_list.php function (in the API v1 User Guide).
  • policy_id — Specifies the policy to run the report on. A valid policy ID must be entered.
  • host_id — In the policy report output, show only results for a single host instance. Specify the ID for the host to include in the report. A valid host ID must be entered.
  • instance_string — Specifies a single instance on the selected host. The instance string may be “os” or a string like “oracle10:1:1521:ora10204u”.

Commands used

qualys-report-fetch qualys-report-launch-compliance-policy

Flowchart

Start Start qualys-report-launch-compliance-policy - qualys-report-launch-compliance-policy qualys-report-launch-comp... qualys-report-launch-complian... qualys-report-fetch - qualys-report-fetch qualys-report-fetch qualys-report-fetch GenericPolling - GenericPolling GenericPolling GenericPolling
id: Launch And Fetch Compliance Policy Report - Qualys
version: -1
name: Launch And Fetch Compliance Policy Report - Qualys
description: Launches a compliance policy report and then fetches the report when it's ready.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: feaf59d2-f107-4395-862c-895cd5406872
    type: start
    task:
      id: feaf59d2-f107-4395-862c-895cd5406872
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 5b82fc23-5579-48f5-8c52-81f17f565803
    type: regular
    task:
      id: 5b82fc23-5579-48f5-8c52-81f17f565803
      version: -1
      name: qualys-report-launch-compliance-policy
      description: Run compliance policy report
      script: QualysV2|||qualys-report-launch-compliance-policy
      type: regular
      iscommand: true
      brand: QualysV2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      asset_group_ids:
        simple: ${inputs.asset_group_ids}
      hide_header:
        simple: ${inputs.hide_header}
      host_id:
        simple: ${inputs.host_id}
      instance_string:
        simple: ${inputs.instance_string}
      ips:
        simple: ${inputs.ips}
      output_format:
        simple: ${inputs.output_format}
      pdf_password:
        simple: ${inputs.pdf_password}
      policy_id:
        simple: ${inputs.policy_id}
      recipient_group:
        simple: ${inputs.recipient_group}
      recipient_group_id:
        simple: ${inputs.recipient_group_id}
      report_title:
        simple: ${inputs.report_title}
      template_id:
        simple: ${inputs.template_id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 973d836a-4892-436b-8d2a-059160cc7f6c
    type: regular
    task:
      id: 973d836a-4892-436b-8d2a-059160cc7f6c
      version: -1
      name: qualys-report-fetch
      description: Download report
      script: QualysV2|||qualys-report-fetch
      type: regular
      iscommand: true
      brand: QualysV2
    scriptarguments:
      execution-timeout:
        simple: "180"
      file_format:
        simple: ${inputs.output_format}
      id:
        simple: ${Qualys.Report.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 9fe76d77-ac51-4c04-862b-eb39c73eecb0
    type: playbook
    task:
      id: 9fe76d77-ac51-4c04-862b-eb39c73eecb0
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        simple: ${Qualys.Report.ID}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: id
      PollingCommandName:
        simple: qualys-report-list
      Timeout:
        simple: "30"
      dt:
        simple: Qualys.Report(val.STATUS.STATE != 'Finished').ID.
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 585,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: template_id
  value: {}
  required: true
  description: The template ID of the report you want to launch. Can be found by running
    the command qualys-report-template-list.
  playbookInputQuery:
- key: output_format
  value: {}
  required: true
  description: One output format can be specified. When output_format=pdf is specified,
    the Secure PDF Distribution can be used.
  playbookInputQuery:
- key: report_title
  value: {}
  required: false
  description: A user-defined report title. The title may have a maximum of 128 characters.
    For a PCI compliance report, the report title is provided by Qualys and cannot
    be changed.
  playbookInputQuery:
- key: hide_header
  value: {}
  required: false
  description: (Valid for CSV format report only). Specify hide_header=1 to omit the
    header information from the report. By default, this information is included.
  playbookInputQuery:
- key: recipient_group_id
  value: {}
  required: false
  description: Specify users who will receive the email notification when the report
    is complete (i.e., supply a distribution group ID). Where do I find this ID? Log
    in to your Qualys account, go to Users > Distribution Groups and select Info for
    a group in the list.
  playbookInputQuery:
- key: pdf_password
  value: {}
  required: false
  description: (Required for secure PDF distribution, Manager or Unit Manager only)
    Used for secure PDF report distribution when this feature is enabled in the user's
    account (under Reports > Setup > Report Share). The password to be used for encryption.
    - the password must have a minimum of 8 characters (ascii), and a maximum of 32
    characters - the password must contain alpha and numeric characters - the password
    cannot match the password for the user’s Qualys account. - the password must follow
    the password security guidelines defined for your subscription (under Users >
    Setup > Security)
  playbookInputQuery:
- key: recipient_group
  value: {}
  required: false
  description: Used for secure PDF distribution. The report recipients in the form
    of one or more distribution group names, as defined using the Qualys UI. Multiple
    distribution groups are comma separated. A maximum of 50 distribution groups may
    be entered.
  playbookInputQuery:
- key: ips
  value: {}
  required: false
  description: (Optional for compliance report) For a compliance report (except a
    PCI report), specify the IPs/ranges you want to include in the report. Multiple
    IPs and/or ranges are comma separated.
  playbookInputQuery:
- key: asset_group_ids
  value: {}
  required: false
  description: (Optional for compliance report) For a compliance report (except a
    PCI report), specify asset groups IDs which identify hosts to include in the report.
    Multiple asset group IDs are comma separated. Looking for asset group IDs? Use
    the asset_group_list.php function (in the API v1 User Guide).
  playbookInputQuery:
- key: policy_id
  value: {}
  required: true
  description: Specifies the policy to run the report on. A valid policy ID must be
    entered.
  playbookInputQuery:
- key: host_id
  value: {}
  required: false
  description: In the policy report output, show only results for a single host instance.
    Specify the ID for the host to include in the report. A valid host ID must be
    entered.
  playbookInputQuery:
- key: instance_string
  value: {}
  required: false
  description: Specifies a single instance on the selected host. The instance string
    may be “os” or a string like “oracle10:1:1521:ora10204u”.
  playbookInputQuery:
outputs: []
tests:
- QualysVulnerabilityManagement-Test
fromversion: 5.5.0
supportedModules:
- agentix
- xsiam