Vulnerability Handling - Qualys Deprecated Hidden

Deprecated. Manage vulnerability remediation using Qualys data, and optionally enrich data with 3rd-party tools. Before you run this playbook, run the "Vulnerability Management - Qualys (Job)" playbook.

Deprecated Content (Deprecated) · 21 tasks · 0 inputs · 0 outputs

Details

IDvulnerability_handling_-_qualys
From Version5.0.0
Tasks21

README

Deprecated. Manages vulnerability remediation using Qualys data, and optionally enrich data with 3rd-party tools.

Before you run this playbook, run the Vulnerability Management - Qualys (Job) playbook.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Vulnerability Management - Qualys - Add custom fields
  • Endpoint Enrichment - Generic
  • CVE Enrichment - Generic
  • Calculate Severity - Generic

Integrations

  • Qualys

Scripts

  • DisplayHTML
  • CloseInvestigation

Commands

  • qualys-host-list
  • qualys-vulnerability-list

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Vulnerability_Handling_Qualys

Commands used

qualys-host-list qualys-vulnerability-list

Flowchart

yes yes yes yes Start Start Get Asset information - qualys-host-list Get Asset information qualys-host-list Get Vulnerability information - qualys-vulnerability-list Get Vulnerability informa... qualys-vulnerability-list Mark important notes Mark important notes Enrich Entities Enrich Entities Display diagnosis - DisplayHTML Display diagnosis DisplayHTML Is there a diagnosis for the vulnerability? Is there a diagnosis for ... Remediate Remediate Endpoint Enrichment - Generic - Endpoint Enrichment - Generic Endpoint Enrichment - Gen... Endpoint Enrichment - Generic CVE Enrichment - Generic - CVE Enrichment - Generic CVE Enrichment - Generic CVE Enrichment - Generic Is Qualys enabled? Is Qualys enabled? Remediate the vulnerability Remediate the vulnerability Close Investigation - CloseInvestigation Close Investigation CloseInvestigation Get incident information from Qualys Get incident information ... Done Done Vulnerability Management - Qualys - Add custom fields - Vulnerability Handling - Qualys - Add custom fields to default layout Vulnerability Management ... Vulnerability Handling - Qual... Calculate Severity - Generic - Calculate Severity - Generic Calculate Severity - Generic Calculate Severity - Generic Is there a consequence for the vulnerability? Is there a consequence fo... Display consequence - DisplayHTML Display consequence DisplayHTML Is there a remediation for the vulnerability? Is there a remediation fo... Display remediation - DisplayHTML Display remediation DisplayHTML

Source

playbook-Vulnerability_Handling_-_Qualys.yml
Download History Raw 
id: vulnerability_handling_-_qualys
version: -1
name: Vulnerability Handling - Qualys
fromversion: 5.0.0
description: |-
  Deprecated. Manage vulnerability remediation using Qualys data, and optionally enrich data with 3rd-party tools.

  Before you run this playbook, run the "Vulnerability Management - Qualys (Job)" playbook.
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 70a808bd-c5f5-4a34-8e73-7bd426ea3c48
    type: start
    task:
      id: 70a808bd-c5f5-4a34-8e73-7bd426ea3c48
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: c028a317-3e87-4ee2-85c9-53754152340d
    type: regular
    task:
      id: c028a317-3e87-4ee2-85c9-53754152340d
      version: -1
      name: Get Asset information
      description: Get asset metadata from Qualys based on Asset ID.
      script: Qualys|||qualys-host-list
      type: regular
      iscommand: true
      brand: Qualys
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      ag_ids: {}
      ag_titles: {}
      compliance_enabled: {}
      compliance_scan_since: {}
      details: {}
      id_max: {}
      id_min: {}
      ids:
        complex:
          root: incident
          accessor: assetid
      ips: {}
      network_ids: {}
      no_compliance_scan_since: {}
      no_vm_scan_since: {}
      os_pattern: {}
      truncation_limit: {}
      vm_scan_since: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1257.5,
          "y": 515
        }
      }
  "2":
    id: "2"
    taskid: a0bb5b2f-f89a-48ec-8cef-70477b2adf1e
    type: regular
    task:
      id: a0bb5b2f-f89a-48ec-8cef-70477b2adf1e
      version: -1
      name: Get Vulnerability information
      description: Get vulnerability metadata from Qualys based on QID.
      script: Qualys|||qualys-vulnerability-list
      type: regular
      iscommand: true
      brand: Qualys
    nexttasks:
      '#none#':
      - "3"
      - "4"
    scriptarguments:
      details: {}
      discovery_auth_types: {}
      discovery_method: {}
      extend-context:
        simple: Qualys.Consequence=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.CONSEQUENCE::Qualys.Diagnosis=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.DIAGNOSIS::Qualys.Solution=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.SOLUTION::CVE.ID=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.CVE_LIST.CVE.ID::Qualys.Severity=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.SEVERITY_LEVEL::Qualys.Category=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.CATEGORY::Qualys.Bugtraq=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.BUGTRAQ_LIST.BUGTRAQ::Qualys.Title=KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.TITLE
      id_max: {}
      id_min: {}
      ids:
        complex:
          root: incident
          accessor: vendorid
      is_patchable: {}
      last_modified_after: {}
      last_modified_before: {}
      last_modified_by_service_after: {}
      last_modified_by_service_before: {}
      last_modified_by_user_after: {}
      last_modified_by_user_before: {}
      published_after: {}
      published_before: {}
      show_pci_reasons: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1257.5,
          "y": 690
        }
      }
  "3":
    id: "3"
    taskid: f557cc38-4b4e-4beb-88fa-55a1c6cc3de6
    type: title
    task:
      id: f557cc38-4b4e-4beb-88fa-55a1c6cc3de6
      version: -1
      name: Mark important notes
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
      - "21"
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 865
        }
      }
  "4":
    id: "4"
    taskid: cdbea748-55ef-48c7-8e82-df37a53667ff
    type: title
    task:
      id: cdbea748-55ef-48c7-8e82-df37a53667ff
      version: -1
      name: Enrich Entities
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
      - "11"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 865
        }
      }
  "5":
    id: "5"
    taskid: d75db3b1-aeec-44f1-88c9-fb782f8f0291
    type: regular
    task:
      id: d75db3b1-aeec-44f1-88c9-fb782f8f0291
      version: -1
      name: 'Display diagnosis '
      description: Display the diagnosis HTML in the War Room.
      scriptName: DisplayHTML
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      header:
        simple: Vulnerability Diagnosis
      html:
        complex:
          root: Qualys
          accessor: Diagnosis
      markAsNote:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1185
        }
      }
  "6":
    id: "6"
    taskid: 3a0acb6e-cd22-42b7-86cf-2c0c638d6e41
    type: condition
    task:
      id: 3a0acb6e-cd22-42b7-86cf-2c0c638d6e41
      version: -1
      name: Is there a diagnosis for the vulnerability?
      description: Verify that there's a diagnosis for the detected vulnerability in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: Qualys
                accessor: Diagnosis
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1010
        }
      }
  "7":
    id: "7"
    taskid: 58ab86c1-fd77-4a67-8804-2e8cc87eedb4
    type: title
    task:
      id: 58ab86c1-fd77-4a67-8804-2e8cc87eedb4
      version: -1
      name: 'Remediate'
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 725,
          "y": 1360
        }
      }
  "10":
    id: "10"
    taskid: 01d06edb-b109-4ce1-8618-ad49f8f33648
    type: playbook
    task:
      id: 01d06edb-b109-4ce1-8618-ad49f8f33648
      version: -1
      name: Endpoint Enrichment - Generic
      description: ""
      playbookName: Endpoint Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      Hostname:
        complex:
          root: Qualys
          accessor: Endpoint.NETBIOS
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 1482.5,
          "y": 1010
        }
      }
  "11":
    id: "11"
    taskid: 60d2a53c-3ae5-453f-875a-1203347f16e7
    type: playbook
    task:
      id: 60d2a53c-3ae5-453f-875a-1203347f16e7
      version: -1
      name: CVE Enrichment - Generic
      description: ""
      playbookName: CVE Enrichment - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1912.5,
          "y": 1010
        }
      }
  "12":
    id: "12"
    taskid: a7ff415a-8066-4f3c-826c-5c6f840075f2
    type: condition
    task:
      id: a7ff415a-8066-4f3c-826c-5c6f840075f2
      version: -1
      name: Is Qualys enabled?
      description: Verify that there's a valid instance of Qualys enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Qualys
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 195
        }
      }
  "14":
    id: "14"
    taskid: 65d23550-509d-4f8b-8f31-a9ec236d59d0
    type: regular
    task:
      id: 65d23550-509d-4f8b-8f31-a9ec236d59d0
      version: -1
      name: 'Remediate the vulnerability '
      description: Manually remediate the vulnerability using the remediation note from Qualys.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 725,
          "y": 1680
        }
      }
  "15":
    id: "15"
    taskid: fd70751e-253f-404b-8820-e63a3eff0d68
    type: regular
    task:
      id: fd70751e-253f-404b-8820-e63a3eff0d68
      version: -1
      name: Close Investigation
      description: Close the investigation.
      scriptName: CloseInvestigation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      notes: {}
      reason: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 725,
          "y": 1855
        }
      }
  "17":
    id: "17"
    taskid: 2d483c30-2066-4696-82f9-781aa207df9f
    type: title
    task:
      id: 2d483c30-2066-4696-82f9-781aa207df9f
      version: -1
      name: Get incident information from Qualys
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1257.5,
          "y": 370
        }
      }
  "18":
    id: "18"
    taskid: ab94f99a-9546-4837-8ed9-cfe970154bea
    type: title
    task:
      id: ab94f99a-9546-4837-8ed9-cfe970154bea
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 725,
          "y": 2030
        }
      }
  "19":
    id: "19"
    taskid: 3e271fab-839e-4253-8aa9-f8579c607fd6
    type: playbook
    task:
      id: 3e271fab-839e-4253-8aa9-f8579c607fd6
      version: -1
      name: Vulnerability Management - Qualys - Add custom fields
      description: ""
      playbookName: Vulnerability Handling - Qualys - Add custom fields to default layout
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1697.5,
          "y": 1185
        }
      }
  "20":
    id: "20"
    taskid: cd0cd64a-046d-467f-836f-3afa1f8e5acf
    type: playbook
    task:
      id: cd0cd64a-046d-467f-836f-3afa1f8e5acf
      version: -1
      name: Calculate Severity - Generic
      description: |-
        Calculate incident severity by indicators reputation and user/endpoint membership in critical groups.

        Note - current severity will be overwritten and new severity may be lower than the current one.

        Playbook inputs:
        * CriticalUsers - Comma separated array with usernames of critical users
        * CriticalEndpoints - Comma separated array with hostnames of critical endpoints
        * CriticalGroups - Comma separated array with DN of critical Active Directory groups
      playbookName: Calculate Severity - Generic
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      CriticalEndpoints: {}
      CriticalGroups: {}
      CriticalUsers: {}
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 725,
          "y": 1505
        }
      }
  "21":
    id: "21"
    taskid: e70ad3fc-4274-4b7b-8e05-564266f65b2e
    type: condition
    task:
      id: e70ad3fc-4274-4b7b-8e05-564266f65b2e
      version: -1
      name: Is there a consequence for the vulnerability?
      description: Verify that there's a consequence for the detected vulnerability in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: Qualys
                accessor: Consequence
            iscontext: true
    view: |-
      {
        "position": {
          "x": 612.5,
          "y": 1010
        }
      }
  "22":
    id: "22"
    taskid: 85f071de-346c-4cf6-8a54-6bef8b32e3c1
    type: regular
    task:
      id: 85f071de-346c-4cf6-8a54-6bef8b32e3c1
      version: -1
      name: 'Display consequence'
      description: Display the remediation HTML in the War Room.
      scriptName: DisplayHTML
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      header:
        simple: Vulnerability Consequence
      html:
        complex:
          root: Qualys
          accessor: Consequence
      markAsNote:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 500,
          "y": 1185
        }
      }
  "23":
    id: "23"
    taskid: e142b442-105b-4016-8d77-40eb431e5503
    type: condition
    task:
      id: e142b442-105b-4016-8d77-40eb431e5503
      version: -1
      name: Is there a remediation for the vulnerability?
      description: Verify that there's a remediation for the detected vulnerability in context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "yes":
      - "24"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: Qualys
                accessor: Solution
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 1010
        }
      }
  "24":
    id: "24"
    taskid: e9c369da-0f47-4243-8628-c8f959084f2d
    type: regular
    task:
      id: e9c369da-0f47-4243-8628-c8f959084f2d
      version: -1
      name: 'Display remediation'
      description: Display the remediation HTML in the War Room.
      scriptName: DisplayHTML
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      header:
        simple: Vulnerability Remediation
      html:
        complex:
          root: Qualys
          accessor: Solution
      markAsNote:
        simple: "true"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1052.5,
          "y": 1185
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "12_7_#default#": 0.52
    },
    "paper": {
      "dimensions": {
        "height": 2045,
        "width": 2242.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
tests:
- No test - Should review soon
deprecated: true