QualysCreateIncidentFromReport

Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID). Duplicate incidents are not created for the same asset ID and QID.

python · Qualys

Details

ID	`QualysCreateIncidentFromReport`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	qualys

README

Creates incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID).
Duplicates the incidents that are not created for the same asset ID and QID.

Script Data

Name	Description
Script Type	python
Tags	qualys

Dependencies

This script uses the following commands and scripts.

qualys-host-list

Inputs

Argument Name	Description
entryID	The War Room entryID of the XML report.
maxFileSize	The maximum file size to load, in bytes. The default is 1024 KB.
minSeverity	The minimum Qualys severity to create incidents for.
incidentType	The incident type to create incidents for. The default is “Vulnerability”.

Outputs

There are no outputs for this script.

Source

QualysCreateIncidentFromReport.py QualysCreateIncidentFromReport_test.py QualysCreateIncidentFromReport.yml

Download History Raw

import demistomock as demisto
from QualysCreateIncidentFromReport import main, get_asset_id_for_ip


def test_main(mocker):
    """
    Tests the full flow of the script

    Given: A valid report and successful responses
    When: Running the QualysCreateIncidentReport script
    Then: Return a successful response

    """
    with open("test_data/qualys_host_list_rawresponse.xml") as f:
        raw_response = f.read()
    mocker.patch.object(demisto, "args", return_value={})
    mocker.patch.object(
        demisto, "getFilePath", return_value={"id": id, "path": "test_data/test_report.xml", "name": "test_report.xml"}
    )
    mocker.patch.object(
        demisto,
        "executeCommand",
        side_effect=[[{"Contents": raw_response, "Type": "notes"}], [{"Contents": {"total": 1}, "Type": "notes"}]],
    )
    demisto_results = mocker.spy(demisto, "results")
    main()
    demisto_results.assert_called_once_with("Done.")


def test_get_asset_id_for_ip(mocker):
    """
    Tests parsing the data returned by qualys-host-list

    Given: A valid response from qualys
    When: Parsing for the incidentid
    Then: Return a valid id

    """
    with open("test_data/qualys_host_list_rawresponse.xml") as f:
        raw_response = f.read()
    mocker.patch.object(demisto, "executeCommand", return_value=[{"Contents": raw_response, "Type": "note"}])
    assert get_asset_id_for_ip("1.1.1.1") == "69291564"