Launch And Fetch VM Scan - Qualys

id: Launch And Fetch VM Scan - Qualys
version: -1
name: Launch And Fetch VM Scan - Qualys
description: Launches a scan and fetches the scan when it's ready.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: feaf59d2-f107-4395-862c-895cd5406872
    type: start
    task:
      id: feaf59d2-f107-4395-862c-895cd5406872
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 54a20ec0-ac65-47ee-8c7e-da5ea4de89a7
    type: regular
    task:
      id: 54a20ec0-ac65-47ee-8c7e-da5ea4de89a7
      version: -1
      name: qualys-vm-scan-launch
      description: launch vulnerability scans in the user’s account.
      script: QualysV2|||qualys-vm-scan-launch
      type: regular
      iscommand: true
      brand: QualysV2
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      asset_group_ids:
        simple: ${inputs.asset_group_ids}
      asset_groups:
        simple: ${inputs.asset_groups}
      client_id:
        simple: ${inputs.client_id}
      client_name:
        simple: ${inputs.client_name}
      connector_name:
        simple: ${inputs.connector_name}
      default_scanner:
        simple: ${inputs.default_scanner}
      ec2_endpoint:
        simple: ${inputs.ec2_endpoint}
      ec2_instance_ids:
        simple: ${inputs.ec2_instance_ids}
      exclude_ip_per_scan:
        simple: ${inputs.exclude_ip_per_scan}
      fqdn:
        simple: ${inputs.fqdn}
      include_agent_targets:
        simple: ${inputs.include_agent_targets}
      ip:
        simple: ${inputs.ip}
      ip_network_id:
        simple: ${inputs.ip_network_id}
      iscanner_id:
        simple: ${inputs.iscanner_id}
      iscanner_name:
        simple: ${inputs.iscanner_name}
      option_id:
        simple: ${inputs.option_id}
      option_title:
        simple: ${inputs.option_title}
      priority:
        simple: ${inputs.priority}
      runtime_http_header:
        simple: ${inputs.runtime_http_header}
      scan_title:
        simple: ${inputs.scan_title}
      scan_type:
        simple: ${inputs.scan_type}
      scanners_in_ag:
        simple: ${inputs.scanners_in_ag}
      scanners_in_network:
        simple: ${inputs.scanners_in_network}
      scanners_in_tagset:
        simple: ${inputs.scanners_in_tagset}
      tag_exclude_selector:
        simple: ${inputs.tag_exclude_selector}
      tag_include_selector:
        simple: ${inputs.tag_include_selector}
      tag_set_by:
        simple: ${inputs.tag_set_by}
      tag_set_exclude:
        simple: ${inputs.tag_set_exclude}
      tag_set_include:
        simple: ${inputs.tag_set_include}
      target_from:
        simple: ${inputs.target_from}
      use_ip_nt_range_tags:
        simple: ${inputs.use_ip_nt_range_tags}
      use_ip_nt_range_tags_exclude:
        simple: ${inputs.use_ip_nt_range_tags_exclude}
      use_ip_nt_range_tags_include:
        simple: ${inputs.use_ip_nt_range_tags_include}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 23044652-7468-4072-81c0-eb5c536ee3d9
    type: regular
    task:
      id: 23044652-7468-4072-81c0-eb5c536ee3d9
      version: -1
      name: qualys-vm-scan-fetch
      description: Download scan results when scan has status Finished, Canceled,
        Paused or Error
      script: QualysV2|||qualys-vm-scan-fetch
      type: regular
      iscommand: true
      brand: QualysV2
    scriptarguments:
      client_id:
        simple: ${inputs.client_id}
      client_name:
        simple: ${inputs.client_name}
      execution-timeout:
        simple: "180"
      ips:
        simple: ${inputs.ips}
      mode:
        simple: ${inputs.mode}
      scan_ref:
        simple: ${Qualys.Report.VM.Launched.[1].VALUE}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: f5c06b89-9fdf-4c09-8160-08aad95379fe
    type: playbook
    task:
      id: f5c06b89-9fdf-4c09-8160-08aad95379fe
      version: -1
      name: GenericPolling
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      Ids:
        simple: ${Qualys.Report.VM.Launched.[1].VALUE}
      Interval:
        simple: "1"
      PollingCommandArgName:
        simple: scan_ref
      PollingCommandName:
        simple: qualys-vm-scan-list
      Timeout:
        simple: "30"
      dt:
        simple: Qualys.Scan(val.STATUS.STATE != 'Finished').REF.
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 585,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: scan_title
  value: {}
  required: false
  description: The scan title. This can be a maximum of 2000 characters (ascii).
  playbookInputQuery:
- key: target_from
  value: {}
  required: false
  description: Specify “assets” (the default) when your scan target will include IP
    addresses/ranges and/or asset groups. Specify “tags” when your scan target will
    include asset tags.
  playbookInputQuery:
- key: ip
  value: {}
  required: false
  description: 'The IP addresses to be scanned. You may enter individual IP addresses
    and/or ranges. Multiple entries are comma separated. One of these parameters is
    required: ip, asset_groups or asset_group_ids.'
  playbookInputQuery:
- key: asset_groups
  value: {}
  required: false
  description: 'The titles of asset groups containing the hosts to be scanned. Multiple
    titles are comma separated. One of these parameters is required: ip, asset_groups
    or asset_group_ids.'
  playbookInputQuery:
- key: asset_group_ids
  value: {}
  required: false
  description: 'The IDs of asset groups containing the hosts to be scanned. Multiple
    IDs are comma separated. One of these parameters is required: ip, asset_groups
    or asset_group_ids.'
  playbookInputQuery:
- key: exclude_ip_per_scan
  value: {}
  required: false
  description: The IP addresses to be excluded from the scan when the scan target
    is specified as IP addresses (not asset tags). You may enter individual IP addresses
    and/or ranges. Multiple entries are comma separated.
  playbookInputQuery:
- key: tag_include_selector
  value: {}
  required: false
  description: Select “any” (the default) to include hosts that match at least one
    of the selected tags. Select “all” to include hosts that match all of the selected
    tags.
  playbookInputQuery:
- key: tag_exclude_selector
  value: {}
  required: false
  description: Select “any” (the default) to exclude hosts that match at least one
    of the selected tags. Select “all” to exclude hosts that match all of the selected
    tags.
  playbookInputQuery:
- key: tag_set_by
  value: {}
  required: false
  description: Specify “id” (the default) to select a tag set by providing tag IDs.
    Specify “name” to select a tag set by providing tag names.
  playbookInputQuery:
- key: tag_set_include
  value: {}
  required: false
  description: Specify a tag set to include. Hosts that match these tags will be included.
    You identify the tag set by providing tag name or IDs. Multiple entries are comma
    separated.
  playbookInputQuery:
- key: tag_set_exclude
  value: {}
  required: false
  description: Specify a tag set to exclude. Hosts that match these tags will be excluded.
    You identify the tag set by providing tag name or IDs. Multiple entries are comma
    separated.
  playbookInputQuery:
- key: use_ip_nt_range_tags_include
  value: {}
  required: false
  description: Specify “0” (the default) to select from all tags (tags with any tag
    rule). Specify “1” to scan all IP addresses defined in tag selection. When this
    is specified, only tags with the dynamic IP address rule called “IP address in
    Network Range(s)” can be selected. valid only when target_from=tags is specified.
  playbookInputQuery:
- key: use_ip_nt_range_tags_exclude
  value: {}
  required: false
  description: Specify “0” (the default) to select from all tags (tags with any tag
    rule). Specify “1” to exclude all IP addresses defined in tag selection. When
    this is specified, only tags with the dynamic IP address rule called “IP address
    in Network Range(s)” can be selected.  valid only when target_from=tags is specified.
  playbookInputQuery:
- key: use_ip_nt_range_tags
  value: {}
  required: false
  description: Specify “0” (the default) to select from all tags (tags with any tag
    rule). Specify “1” to scan all IP addresses defined in tags. When this is specified,
    only tags with the dynamic IP address rule called “IP address in Network Range(s)”
    can be selected.
  playbookInputQuery:
- key: iscanner_id
  value: {}
  required: false
  description: 'The IDs of the scanner appliances to be used. Multiple entries are
    comma separated. For an Express Lite user, Internal Scanning must be enabled in
    the user''s account. One of these parameters must also be specified in a request:
    iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset.
    When none of these are specified, External scanners are used. These parameters
    are mutually exclusive and cannot be specified in the same request: iscanner_id
    and iscanner_name.'
  playbookInputQuery:
- key: iscanner_name
  value: {}
  required: false
  description: Specifies the name of the Scanner Appliance for the map, when the map
    target has private use internal IPs. Using Express Lite, Internal Scanning must
    be enabled in your account.
  playbookInputQuery:
- key: default_scanner
  value: {}
  required: false
  description: Specify 1 to use the default scanner in each target asset group. For
    an Express Lite user, Internal Scanning must be enabled in the user’s account.
  playbookInputQuery:
- key: scanners_in_ag
  value: {}
  required: false
  description: Specify 1 to distribute the scan to the target asset groups’ scanner
    appliances. Appliances in each asset group are tasked with scanning the IPs in
    the group. By default up to 5 appliances per group will be used and this can be
    configured for your account (please contact your Account Manager or Support).
    For an Express Lite user, Internal Scanning must be enabled in the user’s account.
  playbookInputQuery:
- key: scanners_in_tagset
  value: {}
  required: false
  description: 'Specify 1 to distribute the scan to scanner appliances that match
    the asset tags specified for the scan target. One of these parameters must be
    specified in a request for an internal scan: iscanner_name, iscanner_id, default_scanner,
    scanners_in_ag, scanners_in_tagset. When none of these are specified, External
    scanners are used. valid when the target_from=tags is specified.'
  playbookInputQuery:
- key: scanners_in_network
  value: {}
  required: false
  description: Specify 1 to distribute the scan to all scanner appliances in the network.
  playbookInputQuery:
- key: option_title
  value: {}
  required: false
  description: 'The title of the compliance option profile to be used. One of these
    parameters must be specified in a request: option_title or option_id. These are
    mutually exclusive and cannot be specified in the same request.'
  playbookInputQuery:
- key: option_id
  value: {}
  required: false
  description: 'The ID of the compliance option profile to be used. One of these parameters
    must be specified in a request: option_title or option_id. These are mutually
    exclusive and cannot be specified in the same request.'
  playbookInputQuery:
- key: priority
  value: {}
  required: false
  description: Specify a value of 0 - 9 to set a processing priority level for the
    scan. When not specified, a value of 0 (no priority) is used. 0 = No Priority
    (the default), 1 = Emergency, 2 = Ultimate, 3 = Critical, 4 = Major, 5 = High,
    6 = Standard, 7 = Medium, 8 = Minor, 9 = Low
  playbookInputQuery:
- key: connector_name
  value: {}
  required: false
  description: (Required for EC2 scan) The name of the EC2 connector for the AWS integration
    you want to run the scan on.
  playbookInputQuery:
- key: ec2_endpoint
  value: {}
  required: false
  description: (Required for EC2 scan) The EC2 region code or the ID of the Virtual
    Private Cloud (VPC) zone.
  playbookInputQuery:
- key: ec2_instance_ids
  value: {}
  required: false
  description: The ID of the EC2 instance on which you want to launch the VM or compliance
    scan. Multiple ec2 instance ids are comma separated. You can add up to maximum
    10 instance Ids.
  playbookInputQuery:
- key: ip_network_id
  value: {}
  required: false
  description: The ID of a network used to filter the IPs/ranges specified in the“ip”
    parameter. Set to a custom network ID (note this does not filter IPs/ranges specified
    in “asset_groups” or “asset_group_ids”). Or set to “0” (the default) for the Global
    Default Network - this is used to scan hosts outside of your custom networks.
  playbookInputQuery:
- key: runtime_http_header
  value: {}
  required: false
  description: Set a custom value in order to drop defenses (such as logging, IPs,
    etc) when an authorized scan is being run. The value you enter will be used in
    the “Qualys-Scan:” header that will be set for many CGI and web application fingerprinting
    checks. Some discovery and web server fingerprinting checks will not use this
    header.
  playbookInputQuery:
- key: scan_type
  value: {}
  required: false
  description: Launch a CertView type scan. This option will be supported when CertView
    GA is released and enabled for your account.
  playbookInputQuery:
- key: fqdn
  value: {}
  required: false
  description: The target FQDN for a vulnerability scan. You must specify at least
    one target i.e. IPs, asset groups or FQDNs. Multiple values are comma separated.
  playbookInputQuery:
- key: client_id
  value: {}
  required: false
  description: Id assigned to the client (Consultant type subscription only). Parameter
    client_id or client_name may be specified for the same request.
  playbookInputQuery:
- key: client_name
  value: {}
  required: false
  description: Name of the client (Consultant type subscriptions  only). Parameter
    client_id or client_name may be specified for the same request.
  playbookInputQuery:
- key: include_agent_targets
  value: {}
  required: false
  description: Specify 1 when your scan target includes agent hosts. This lets you
    scan private IPs where agents are installed when these IPs are not in your VM/PC
    license.
  playbookInputQuery:
- key: ips
  value: {}
  required: false
  description: 'qualys-vm-scan-fetch - Show only certain IP addresses/ranges in the
    scan results. One or more IPs/ranges may be specified. A range entry is specified
    using a hyphen (for example, 10.10.10.1-10.10.10.20). Multiple entries are comma
    separated. '
  playbookInputQuery:
- key: mode
  value: {}
  required: false
  description: 'qualys-vm-scan-fetch - The verbosity of the scan results details.
    One verbosity mode may be specified: brief (the default) or extended. The brief
    output includes this information: IP address, DNS hostname, NetBIOS hostname,
    QID and scan test results if applicable. The extended output includes the brief
    output plus this extended information: protocol, port, an SSL flag (“yes” is returned
    when SSL was used for the detection, “no” is returned when SSL was not used),
    and FQDN if applicable.'
  playbookInputQuery:
outputs:
- contextPath: Qualys.Report.VM.Launched
  type: unknown
  description: Launched VM scan.
tests:
- QualysVulnerabilityManagement-Test
fromversion: 5.5.0
supportedModules:
- agentix
- xsiam