Vulnerability Management - Qualys (Job) Deprecated

Deprecated. Use the `Vulnerability Management - Qualys (Job) - V2` playbook instead. Use the latest Qualys report to manage vulnerabilities. This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities. The incidents are created from the latest version of the report determined by the report timestamp. You can define the minimum severity (minSeverity) that incidents are created for. Duplicate incidents are not created for the same asset ID and QID. This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation. For this series of playbooks to run successfully, create a Job and do the following: 1. Assign this playbook to the Job 2. Enter the Qualys XML report name into the "Details" field 3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook.

Qualys · 11 tasks · 2 inputs · 0 outputs

Details

ID	`vulnerability_management_-_qualys_Job`
From Version	5.0.0
Tasks	11

README

Deprecated. Use the Vulnerability Management - Qualys (Job) - V2 playbook instead.
Use the latest Qualys report to manage vulnerabilities.

This playbook runs as a job, and by default creates incidents of type “Vulnerability” based on assets and vulnerabilities.
The incidents are created from the latest version of the report determined by the report timestamp.
You can define the minimum severity (minSeverity) that incidents are created for.
Duplicate incidents are not created for the same asset ID and QID.

This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation.
For this series of playbooks to run successfully, create a Job and do the following:

Assign this playbook to the Job
Enter the Qualys XML report name into the “Details” field
Associate the Vulnerability type incident to the Vulnerability Handling - Qualys playbook.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Qualys

Scripts

QualysCreateIncidentFromReport
Set

Commands

qualys-report-list
qualys-report-fetch
closeInvestigation

Playbook Inputs

Name	Description	Default Value	Required
QualysReportTitle	The report title as it appears in Qualys. Has to be in XML format.	incident.details	Required
MinSeverity	The minimum Qualys severity (1 -5) to create incidents for.	3	Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Vulnerability Management - Qualys (Job)

Inputs

QualysReportTitle — The report title as it appears in Qualys. Has to be in XML format.
MinSeverity — The minimum Qualys severity (1 -5) to create incidents for

Commands used

closeInvestigation qualys-report-fetch qualys-report-list

Flowchart

Source

playbook-Vulnerability_Management_-_Qualys_(Job).yml playbook-Vulnerability_Management_-_Qualys_(Job)_-_V2.yml playbook-Vulnerability_Management_-_Qualys_(Job)_-_V2_README.md

Download History Raw

id: vulnerability_management_-_qualys_Job
version: -1
name: Vulnerability Management - Qualys (Job)
fromversion: 5.0.0
deprecated: true
description: |-
  Deprecated. Use the `Vulnerability Management - Qualys (Job) - V2` playbook instead.
  Use the latest Qualys report to manage vulnerabilities.

  This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities.
  The incidents are created from the latest version of the report determined by the report timestamp.
  You can define the minimum severity (minSeverity) that incidents are created for.
  Duplicate incidents are not created for the same asset ID and QID.

  This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation.
  For this series of playbooks to run successfully, create a Job and do the following:
  1. Assign this playbook to the Job
  2. Enter the Qualys XML report name into the "Details" field
  3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 44eb6f9d-29e2-449e-85fd-2077af1ff45e
    type: start
    task:
      id: 44eb6f9d-29e2-449e-85fd-2077af1ff45e
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 50
        }
      }
  "2":
    id: "2"
    taskid: 1471cc73-16be-429c-8619-b07e7e7271ba
    type: regular
    task:
      id: 1471cc73-16be-429c-8619-b07e7e7271ba
      version: -1
      name: Get Qualys reports list
      description: Retrieve a list of all reports from Qualys. Can be filtered by the `expires_before_datetime` parameter.
      script: Qualys|||qualys-report-list
      type: regular
      iscommand: true
      brand: Qualys
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      expires_before_datetime: {}
      id: {}
      state: {}
      user_login: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 515
        }
      }
  "3":
    id: "3"
    taskid: 4ae94d3c-f26b-4d09-89a7-7e2d087a5549
    type: condition
    task:
      id: 4ae94d3c-f26b-4d09-89a7-7e2d087a5549
      version: -1
      name: Is there a valid report?
      description: Check if there's a Qualys report that matches the input report name and is in XML format.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "YES":
      - "11"
    separatecontext: false
    conditions:
    - label: "YES"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: QualysReport
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: QualysReport.Title
                      iscontext: true
                    right:
                      value:
                        simple: inputs.QualysReportTitle
                      iscontext: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: QualysReport.Status.State
                      iscontext: true
                    right:
                      value:
                        simple: Finished
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: QualysReport.OutputFormat
                      iscontext: true
                    right:
                      value:
                        simple: XML
                accessor: ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 865
        }
      }
  "5":
    id: "5"
    taskid: 03b60980-2f8f-4dc6-830e-781a10150988
    type: title
    task:
      id: 03b60980-2f8f-4dc6-830e-781a10150988
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1710
        }
      }
  "7":
    id: "7"
    taskid: 73f17571-d171-4ba5-8cd0-d4b39cfd62ab
    type: title
    task:
      id: 73f17571-d171-4ba5-8cd0-d4b39cfd62ab
      version: -1
      name: Create incidents from the Qualys report
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1215
        }
      }
  "8":
    id: "8"
    taskid: a898c316-7a9a-4c01-8984-e02c4a572a17
    type: regular
    task:
      id: a898c316-7a9a-4c01-8984-e02c4a572a17
      version: -1
      name: Create incidents from the Qualys report
      description: |-
        Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID).
        Duplicate incidents are not created for the same asset ID and QID.
      scriptName: QualysCreateIncidentFromReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      entryID:
        complex:
          root: File
          filters:
          - - operator: string.isEqual
              left:
                value:
                  simple: File.Info
                iscontext: true
              right:
                value:
                  simple: application/xml
              ignorecase: true
          accessor: EntryID
      maxFileSize: {}
      minSeverity:
        simple: ${inputs.MinSeverity}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1360
        }
      }
  "10":
    id: "10"
    taskid: 7bd9b687-d830-4ef7-8f2c-11430ace9299
    type: condition
    task:
      id: 7bd9b687-d830-4ef7-8f2c-11430ace9299
      version: -1
      name: Is Qualys enabled?
      description: Verify that there's a valid instance of Qualys enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Qualys
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 195
        }
      }
  "11":
    id: "11"
    taskid: 4e17432e-44c3-41c2-8c3a-50b477ac0d64
    type: regular
    task:
      id: 4e17432e-44c3-41c2-8c3a-50b477ac0d64
      version: -1
      name: Get report
      description: Retrieve the report from Qualys.
      script: Qualys|||qualys-report-fetch
      type: regular
      iscommand: true
      brand: Qualys
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      id:
        complex:
          root: QualysReport
          filters:
          - - operator: string.isEqual
              left:
                value:
                  simple: QualysReport.Title
                iscontext: true
              right:
                value:
                  simple: inputs.QualysReportTitle
                iscontext: true
          - - operator: string.isEqual
              left:
                value:
                  simple: QualysReport.Status.State
                iscontext: true
              right:
                value:
                  simple: Finished
              ignorecase: true
          - - operator: string.isEqual
              left:
                value:
                  simple: QualysReport.OutputFormat
                iscontext: true
              right:
                value:
                  simple: XML
              ignorecase: true
          accessor: ID
          transformers:
          - operator: general.atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1040
        }
      }
  "12":
    id: "12"
    taskid: 760d26bf-1cf0-453e-874d-6289febaf523
    type: regular
    task:
      id: 760d26bf-1cf0-453e-874d-6289febaf523
      version: -1
      name: Set context
      description: 'Set the Qualys reports list into context. '
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: QualysReport
      value:
        complex:
          root: Qualys
          accessor: Report
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 690
        }
      }
  "14":
    id: "14"
    taskid: f6e8fab3-d733-4383-8969-f1db2e0850b6
    type: regular
    task:
      id: f6e8fab3-d733-4383-8969-f1db2e0850b6
      version: -1
      name: Close Investigation
      description: Close the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      id: {}
      importantfield: {}
      test2: {}
      timefield1: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 279,
          "y": 1535
        }
      }
  "15":
    id: "15"
    taskid: d810fa86-61da-49c6-84c6-1216e66f77bb
    type: title
    task:
      id: d810fa86-61da-49c6-84c6-1216e66f77bb
      version: -1
      name: Get report from Qualys
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1725,
        "width": 609,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: QualysReportTitle
  value:
    complex:
      root: incident
      accessor: details
  required: true
  description: "The report title as it appears in Qualys.\nHas to be in XML format. "
- key: MinSeverity
  value:
    simple: "3"
  required: true
  description: The minimum Qualys severity (1 -5) to create incidents for
outputs: []
tests:
- No test
marketplaces:
  - xsoar