Launch And Fetch Host Based Findings Report - Qualys

id: Launch And Fetch Host Based Findings Report - Qualys
version: -1
name: Launch And Fetch Host Based Findings Report - Qualys
description: Launches a host based report and fetches the report when it's
  ready.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: feaf59d2-f107-4395-862c-895cd5406872
    type: start
    task:
      id: feaf59d2-f107-4395-862c-895cd5406872
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 1cf38b7c-b0a7-4d1d-8d40-84a54dd5d7ba
    type: regular
    task:
      id: 1cf38b7c-b0a7-4d1d-8d40-84a54dd5d7ba
      version: -1
      name: qualys-report-launch-host-based-findings
      description: Run host based findings report
      script: QualysV2|||qualys-report-launch-host-based-findings
      type: regular
      iscommand: true
      brand: QualysV2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      asset_group_ids:
        simple: ${inputs.asset_group_ids}
      hide_header:
        simple: ${inputs.hide_header}
      ips:
        simple: ${inputs.ips}
      ips_network_id:
        simple: ${inputs.ips_network_id}
      output_format:
        simple: ${inputs.output_format}
      pdf_password:
        simple: ${inputs.pdf_password}
      recipient_group:
        simple: ${inputs.recipient_group}
      recipient_group_id:
        simple: ${inputs.recipient_group_id}
      report_title:
        simple: ${inputs.report_title}
      template_id:
        simple: ${inputs.template_id}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 9ef2d59d-bbaa-4c75-8849-64f1265e069c
    type: regular
    task:
      id: 9ef2d59d-bbaa-4c75-8849-64f1265e069c
      version: -1
      name: qualys-report-fetch
      description: Download report
      script: QualysV2|||qualys-report-fetch
      type: regular
      iscommand: true
      brand: QualysV2
    scriptarguments:
      execution-timeout:
        simple: "180"
      file_format:
        simple: ${inputs.output_format}
      id:
        simple: ${Qualys.Report.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 41604736-edc1-4f39-81c5-0d7711b91261
    type: playbook
    task:
      id: 41604736-edc1-4f39-81c5-0d7711b91261
      version: -1
      name: GenericPolling
      description: |-
        Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continuously running the command in Step \#2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        simple: ${Qualys.Report.ID}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: id
      PollingCommandName:
        simple: qualys-report-list
      Timeout:
        simple: "30"
      dt:
        simple: Qualys.Report(val.STATUS.STATE != 'Finished').ID.
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 585,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: template_id
  value: {}
  required: true
  description: The template ID of the report you want to launch. Can be found by running the
    qualys-report-template-list command.
  playbookInputQuery:
- key: output_format
  value: {}
  required: true
  description: One output format may be specified. When output_format=pdf is specified,
    the Secure PDF Distribution may be used.
  playbookInputQuery:
- key: report_title
  value: {}
  required: false
  description: A user-defined report title. The title may have a maximum of 128 characters.
    For a PCI compliance report, the report title is provided by Qualys and cannot
    be changed.
  playbookInputQuery:
- key: hide_header
  value: {}
  required: false
  description: (Valid for CSV format report only). Specify hide_header=1 to omit the
    header information from the report. By default, this information is included.
  playbookInputQuery:
- key: recipient_group_id
  value: {}
  required: false
  description: Specify users who will receive the email notification when the report
    is complete (i.e,. supply a distribution group ID). Where do I find this ID? Log
    in to your Qualys account, go to Users > Distribution Groups and select Info for
    a group in the list.
  playbookInputQuery:
- key: pdf_password
  value: {}
  required: false
  description: '''(Optional; Required for secure PDF distribution) The password to
    be used for encryption. Requirements: - the password must have a minimum of 8
    characters (ascii), and a maximum of 32 characters - the password must contain
    alpha and numeric characters - the password cannot match the password for the
    user’s Qualys account. - the password must follow the password security guidelines
    defined for your subscription (log in and go to Subscription Setup—>Security Options).'''
  playbookInputQuery:
- key: recipient_group
  value: {}
  required: false
  description: Optional; Optional for secure PDF distribution) The report recipients
    in the form of one or more distribution groups, as defined using the Qualys UI.
    Multiple distribution groups are comma separated. A maximum of 50 distribution
    groups may be entered. Chapter 4 — Report API Launch Report  recipient_group={value}
  playbookInputQuery:
- key: ips
  value: {}
  required: false
  description: Specify IPs/ranges to change (override) the report target, as defined
    in the scan report template. Multiple IPs/ranges are comma separated. When specified,
    hosts defined in the report template are not included in the report. See also
    “Using Asset Tags.”
  playbookInputQuery:
- key: asset_group_ids
  value: {}
  required: false
  description: Specify asset group IDs to change (override) the report target, as
    defined in the scan report template. When specified, hosts defined in the report
    template are not included in the report. Looking for asset group IDs? Use the
    asset_group_list.php function (see the API v1 User Guide).
  playbookInputQuery:
- key: ips_network_id
  value: {}
  required: false
  description: Optional, and valid only when the Network Support feature is enabled
    for the user’s account) The ID of a network that is used to restrict the report’s
    target to the IPs/ranges specified in the“ips” parameter. Set to a custom network
    ID (note this does not filter IPs/ranges specified in “asset_group_ids”). Or set
    to “0” (the default) for the Global Default Network - this is used to report on
    hosts outside of your custom networks.
  playbookInputQuery:
outputs: []
tests:
- QualysVulnerabilityManagement-Test
fromversion: 5.5.0
supportedModules:
- agentix
- xsiam