category: IT Services
provider: Qualys
sectionorder:
- Connect
- Collect
commonfields:
  id: qualys_fim
  version: -1
configuration:
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: |-
    The Qualys API server URL that you should use for API requests depends on the platform where your account is located.
    Platforms and URLS:
    Qualys US Platform 1: https://gateway.qg1.apps.qualys.com
    Qualys US Platform 2: https://gateway.qg2.apps.qualys.com
    Qualys US Platform 3: https://gateway.qg3.apps.qualys.com
    Qualys EU Platform 1: https://gateway.qg1.apps.qualys.eu
    Qualys EU Platform 2: https://gateway.qg2.apps.qualys.eu
    Qualys India Platform 1: https://gateway.qg1.apps.qualys.in
    Qualys Private Cloud Platform(Custom Platform): https://gateway.<customer_base_url>
  display: Qualys API Platform URL
  name: platform
  required: true
  type: 0
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- additionalinfo: First fetch timestamp (<number> <time unit>) e.g., 12 hours, 7 days etc.
  defaultvalue: 7 days
  display: Fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- additionalinfo: Max Fetch is limited to 200 incidents per fetch. Choose a value lower than 200.
  defaultvalue: '50'
  display: Max Fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- additionalinfo: |-
    Filter the incidents fetching by providing a query using Qualys syntax.
    i.e., "id:ebe6c64a-8b0d-3401-858d-d57fb25860c7"
    Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
    https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
  display: Fetch Filter
  name: fetch_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Log and track file changes across global IT systems.
display: Qualys FIM
name: qualys_fim
script:
  commands:
  - arguments:
    - description: |-
        Filter the events list by providing a query using Qualys syntax.
        i.e., "id:ebe6c64a-8b0d-3401-858d-d57fb25860c7".
        Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
        https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
      name: filter
    - defaultValue: '0'
      description: Page number (index) to list items from. The "limit" argument defines the page size (the number of items in a page).
      name: page_number
    - defaultValue: '10'
      description: The number of records to include.
      name: limit
    - description: Comma-separated list of incident IDs to be included while searching for events in incidents.
      name: incident_ids
    - auto: PREDEFINED
      default: true
      defaultValue: most_recent
      description: 'The method by which to sort the requested events. Possible values: "most_recent" and "least_recent".'
      name: sort
      predefined:
      - most_recent
      - least_recent
    description: Retrieve a list of all FIM events from the current user account.
    name: qualys-fim-events-list
    outputs:
    - contextPath: QualysFIM.Events.id
      description: Event ID.
      type: String
    - contextPath: QualysFIM.Events.fullPath
      description: Full path of the event.
      type: String
    - contextPath: QualysFIM.Events.dateTime
      description: Date/time the event occurred.
      type: String
    - contextPath: QualysFIM.Events.severity
      description: Event severity.
      type: Number
    - contextPath: QualysFIM.Events.agentId
      description: Agent ID.
      type: String
  - arguments:
    - description: ID of the event to retrieve information about.
      name: event_id
      required: true
    description: Retrieve information about a given event, by event ID.
    name: qualys-fim-event-get
    outputs:
    - contextPath: QualysFIM.Event.id
      description: Event ID.
      type: String
    - contextPath: QualysFIM.Event.fullPath
      description: Full path of the event.
      type: String
    - contextPath: QualysFIM.Event.dateTime
      description: Date/time the event occurred.
      type: String
    - contextPath: QualysFIM.Event.name
      description: Event name.
      type: String
    - contextPath: QualysFIM.Event.severity
      description: Event severity.
      type: Number
    - contextPath: QualysFIM.Event.action
      description: Event action.
      type: String
    - contextPath: QualysFIM.Event.incidentId
      description: Event ID.
      type: String
    - contextPath: QualysFIM.Event.profiles
      description: List of all monitoring profiles name.
      type: unknown
  - arguments:
    - description: |-
        Filter the events list by providing a query using Qualys syntax.
        i.e., "id:ebe6c64a-8b0d-3401-858d-d57fb25860c7"
        Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
        https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
      name: filter
    - defaultValue: '0'
      description: Page number (index) to list items from. The "limit" argument defines the page size (the number of items in a page).
      name: page_number
    - defaultValue: '10'
      description: The number of records to include.
      name: limit
    - description: |-
        Comma-separated list of attributes to include in the response.
        By default, all attributes will be returned in the result,
        i.e., attributes="attributes=name,id".
      isArray: true
      name: attributes
    - auto: PREDEFINED
      default: true
      defaultValue: most_recent
      description: 'The method by which to sort the requested events. Possible values: "most_recent" and "least_recent".'
      name: sort
      predefined:
      - most_recent
      - least_recent
    description: Retrieve a list of all FIM incidents from the current user account.
    name: qualys-fim-incidents-list
    outputs:
    - contextPath: QualysFIM.Incidents.id
      description: Incident ID.
      type: String
    - contextPath: QualysFIM.Incidents.name
      description: Incident name.
      type: String
    - contextPath: QualysFIM.Incidents.type
      description: Incident type.
      type: String
    - contextPath: QualysFIM.Incidents.occurred
      description: Indicates when the incident was created.
      type: String
    - contextPath: QualysFIM.Incidents.username
      description: Name of the user who created this incident.
      type: String
    - contextPath: QualysFIM.Incidents.status
      description: Incident status.
      type: String
  - arguments:
    - description: ID of the incident to retrieve the events for.
      name: incident_id
      required: true
    - description: |-
        Filter the events list by providing a query using Qualys syntax.
        i.e., "id:ebe6c64a-8b0d-3401-858d-d57fb25860c7"
        Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
        https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
      name: filter
    - defaultValue: '0'
      description: Page number (index) to list items from. The "limit" argument defines the page size (the number of items in a page).
      name: page_number
    - default: true
      defaultValue: '10'
      description: The number of records to include.
      name: limit
    - description: |-
        Comma-separated list of attributes to include in the response.
        By default, all attributes will be returned in the result,
        i.e., attributes="attributes=name,id".
      isArray: true
      name: attributes
    description: Retrieve a list of the events logged under an incident.
    name: qualys-fim-incidents-get-events
    outputs:
    - contextPath: QualysFIM.IncidentEvents.id
      description: Event ID.
      type: String
    - contextPath: QualysFIM.IncidentEvents.name
      description: Event name.
      type: String
    - contextPath: QualysFIM.IncidentEvents.severity
      description: Event severity.
      type: String
    - contextPath: QualysFIM.IncidentEvents.type
      description: Event type.
      type: String
    - contextPath: QualysFIM.IncidentEvents.occurred
      description: Indicates when the event was created.
      type: String
    - contextPath: QualysFIM.IncidentEvents.username
      description: Name of the user who created this incident.
      type: String
    - contextPath: QualysFIM.IncidentEvents.status
      description: Incident status.
      type: String
    - contextPath: QualysFIM.IncidentEvents.action
      description: Action that was taken that triggered the event creation.
      type: String
  - arguments:
    - description: |-
        Date from which to start the event search.
        Example format: yyyy-mm-dd, 2021-01-01.
      name: from_date
      predefined:
      - ''
    - description: |-
        Date at which to stop the event search.
        Example format: yyyy-mm-dd, 2021-02-30.
      name: to_date
    - description: |-
        Filter the events list by providing a query using Qualys syntax. i.e., "dateTime : ['2021-01-01'..'2021-03-29']
        When you use this argument it will overwrite the "from_date" and "to_date" arguments.
        If you don't use the filter, the query will include the events from the last 24 hours.
        Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
        https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
      name: filters
    - description: 'The name of the incident. Must be less than 128 characters.'
      name: name
      required: true
    - description: Reviewers who will approve the incident.
      name: reviewers
    - description: Comments for approval of the incident.
      name: comment
    description: Create a manual FIM incident of type "DEFAULT".
    name: qualys-fim-incident-create
    outputs:
    - contextPath: QualysFIM.CreatedIncident.id
      description: Incident ID.
      type: String
    - contextPath: QualysFIM.CreatedIncident.name
      description: Incident name.
      type: String
    - contextPath: QualysFIM.CreatedIncident.occurred
      description: Indicates when the incident was created.
      type: String
    - contextPath: QualysFIM.CreatedIncident.username
      description: Name of the user who created the incident.
      type: String
    - contextPath: QualysFIM.CreatedIncident.status
      description: Incident status.
      type: String
    - contextPath: QualysFIM.CreatedIncident.reviewers
      description: List of reviewers who will approve the incident.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: 'The approval status of the incident. Possible values: "APPROVED", "POLICY_VIOLATION", "UNAPPROVED".'
      name: approval_status
      predefined:
      - APPROVED
      - POLICY_VIOLATION
      - UNAPPROVED
      required: true
    - auto: PREDEFINED
      description: 'Type of incidents. Possible values: "MANUAL", "AUTOMATED", "COMPROMISE", "OTHER".'
      name: change_type
      predefined:
      - MANUAL
      - AUTOMATED
      - COMPROMISE
      - OTHER
      required: true
    - description: Comments for the incidents.
      name: comment
      required: true
    - description: Incident ID to approve.
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: 'The category of the incident created by the rule. Possible values: "PATCHING", "PRE_APPROVED_CHANGE_CONTROL", "CONFIGURATION_CHANGE", "HUMAN_ERROR", "DATA_CORRUPTION", "EMERGENCY_CHANGE", "CHANGE_CONTROL_VIOLATION", "GENERAL_HACKING", "MALWARE".'
      name: disposition_category
      predefined:
      - PATCHING
      - PRE_APPROVED_CHANGE_CONTROL
      - CONFIGURATION_CHANGE
      - HUMAN_ERROR
      - DATA_CORRUPTION
      - EMERGENCY_CHANGE
      - CHANGE_CONTROL_VIOLATION
      - GENERAL_HACKING
      - MALWARE
      required: true
    description: Mark an existing FIM incident as approved.
    name: qualys-fim-incident-approve
    outputs:
    - contextPath: QualysFIM.ApprovedIncident.id
      description: Incident ID.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.name
      description: Incident name.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.type
      description: Incident type.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.filterFromDate
      description: The date from which to filter the approved incident.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.filterToDate
      description: The date until when to filter the approved incident.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.approvalDate
      description: Approval date of the incident.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.approvalStatus
      description: Approval status of the incident.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.comment
      description: Comments for incidents created by the rule.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.username
      description: Name of the user who created this incident.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.status
      description: Incident status.
      type: String
    - contextPath: QualysFIM.ApprovedIncident.reviewers
      description: List of reviewers who will approve the incident.
      type: String
  - arguments:
    - description: |-
        Comma-separated list of attributes to include in the response.
        By default, all attributes will be returned in the result,
        i.e., attributes="attributes=interfaces.hostname".
      name: attributes
    - description: |-
        Filter the events list by providing a query using Qualys syntax.
        i.e., "id:ebe6c64a-8b0d-3401-858d-d57fb25860c7"
        Refer to the "How to Search" Qualys FIM guide for more information about Qualys syntax:
        https://qualysguard.qg2.apps.qualys.com/fim/help/search/language.htm
      name: filter
    - defaultValue: '0'
      description: Page number (index) to list items from. The "limit" argument defines the page size (the number of items in a page).
      name: page_number
    - default: true
      defaultValue: '10'
      description: The number of records to include.
      name: limit
    description: Retrieve a list of all FIM assets.
    name: qualys-fim-assets-list
    outputs:
    - contextPath: QualysFIM.Assets.hostname
      description: Asset hostname.
      type: String
    - contextPath: QualysFIM.Assets.lastCheckedIn
      description: Date the asset was last checked.
      type: String
    - contextPath: QualysFIM.Assets.created
      description: Date the asset was created.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- QualysFIM-Playbook