id: Vulnerability Management - Qualys (Job) - V2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Vulnerability Management - Qualys (Job) - V2
description: |-
  Use the latest Qualys report to manage vulnerabilities.

  This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities.
  The incidents are created from the latest version of the report determined by the report timestamp.
  You can define the minimum severity (minSeverity) that incidents are created for.
  Duplicate incidents are not created for the same asset ID and QID.

  This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation.
  For this series of playbooks to run successfully, create a Job and do the following:
  1. Assign this playbook to the Job
  2. Enter the Qualys XML report name into the "Details" field
  3. Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7f961527-fa7b-45be-89e9-774498cd01d2
    type: start
    task:
      id: 7f961527-fa7b-45be-89e9-774498cd01d2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 285,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 22eb1f09-3413-41f1-8033-d1b9577514e3
    type: regular
    task:
      id: 22eb1f09-3413-41f1-8033-d1b9577514e3
      version: -1
      name: Get Qualys reports list
      description: Get a list of generated reports in the system
      script: QualysV2|||qualys-report-list
      type: regular
      iscommand: true
      brand: QualysV2
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 515
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 7dff1f52-0355-446f-8ddd-55fb208102bf
    type: condition
    task:
      id: 7dff1f52-0355-446f-8ddd-55fb208102bf
      version: -1
      name: Is there a valid report?
      description: Check if there's a Qualys report that matches the input report
        name and is in XML format.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "YES":
      - "11"
    separatecontext: false
    conditions:
    - label: "YES"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: QualysReport
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: QualysReport.TITLE
                      iscontext: true
                    right:
                      value:
                        simple: inputs.QualysReportTitle
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: QualysReport.STATUS.STATE
                      iscontext: true
                    right:
                      value:
                        simple: Finished
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: QualysReport.OUTPUT_FORMAT
                      iscontext: true
                    right:
                      value:
                        simple: XML
                accessor: ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 1040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 6d394517-98d9-4c1d-875f-ef64434a182c
    type: title
    task:
      id: 6d394517-98d9-4c1d-875f-ef64434a182c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 285,
          "y": 1885
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: d06386dc-5eb7-4039-8202-28a535bc1b2a
    type: title
    task:
      id: d06386dc-5eb7-4039-8202-28a535bc1b2a
      version: -1
      name: Create incidents from the Qualys report
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": 1390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: c6fd6734-160c-4750-8710-663831ff092b
    type: regular
    task:
      id: c6fd6734-160c-4750-8710-663831ff092b
      version: -1
      name: Create incidents from the Qualys report
      description: |-
        Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID).
        Duplicate incidents are not created for the same asset ID and QID.
      scriptName: QualysCreateIncidentFromReport
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      entryID:
        complex:
          root: InfoFile
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: InfoFile.Info
                iscontext: true
              right:
                value:
                  simple: application/xml
            - operator: isEqualString
              left:
                value:
                  simple: InfoFile.Info
                iscontext: true
              right:
                value:
                  simple: text/xml; charset=utf-8
          accessor: EntryID
      minSeverity:
        simple: ${inputs.MinSeverity}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": 1535
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: a70301a2-a319-4b6d-8edd-17c38b1410f9
    type: condition
    task:
      id: a70301a2-a319-4b6d-8edd-17c38b1410f9
      version: -1
      name: Is Qualys enabled?
      description: Verify that there's a valid instance of Qualys enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QualysV2
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 285,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5dec9d38-45d4-4310-8164-b2fa5205ee03
    type: regular
    task:
      id: 5dec9d38-45d4-4310-8164-b2fa5205ee03
      version: -1
      name: Get report
      description: Download report
      script: QualysV2|||qualys-report-fetch
      type: regular
      iscommand: true
      brand: QualysV2
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      file_format:
        simple: xml
      id:
        complex:
          root: QualysReport
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: QualysReport.TITLE
                iscontext: true
              right:
                value:
                  simple: inputs.QualysReportTitle
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: QualysReport.STATUS.STATE
                iscontext: true
              right:
                value:
                  simple: Finished
              ignorecase: true
          - - operator: isEqualString
              left:
                value:
                  simple: QualysReport.OUTPUT_FORMAT
                iscontext: true
              right:
                value:
                  simple: XML
              ignorecase: true
          accessor: ID
          transformers:
          - operator: atIndex
            args:
              index:
                value:
                  simple: "0"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 4a963bb8-5c10-4e11-8b9a-8175631ddb97
    type: regular
    task:
      id: 4a963bb8-5c10-4e11-8b9a-8175631ddb97
      version: -1
      name: Set context
      description: 'Set the Qualys reports list into context. '
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: QualysReport
      value:
        complex:
          root: Qualys
          accessor: Report
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 865
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: b0d591d2-0284-4904-8e79-97e1eaf96134
    type: regular
    task:
      id: b0d591d2-0284-4904-8e79-97e1eaf96134
      version: -1
      name: Close Investigation
      description: Close the investigation.
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 622.5,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 0e767276-5a35-4381-8498-86f7207cfcee
    type: title
    task:
      id: 0e767276-5a35-4381-8498-86f7207cfcee
      version: -1
      name: Get report from Qualys
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 6915e155-700d-41f3-8416-dd85f2fc79d1
    type: regular
    task:
      id: 6915e155-700d-41f3-8416-dd85f2fc79d1
      version: -1
      name: PrintErrorEntry
      description: Prints an error entry with a given message
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      message:
        simple: Qualys integration instance is not enabled
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 00b2d65f-9aae-4b06-88c4-ead7b0d26cba
    type: condition
    task:
      id: 00b2d65f-9aae-4b06-88c4-ead7b0d26cba
      version: -1
      name: Is there any report?
      description: Checks if any report was returned from Qualys
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Qualys.Report
                accessor: ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 397.5,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "17_5_#default#": 0.5,
      "3_5_#default#": 0.9
    },
    "paper": {
      "dimensions": {
        "height": 1900,
        "width": 952.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: QualysReportTitle
  value:
    complex:
      root: incident
      accessor: details
  required: true
  description: "The report title as it appears in Qualys.\nHas to be in XML format. "
  playbookInputQuery:
- key: MinSeverity
  value:
    simple: "3"
  required: true
  description: The minimum Qualys severity (1 -5) to create incidents for
  playbookInputQuery:
outputs: []
tests:
- QualysVulnerabilityManagement-Test
fromversion: 5.5.0
marketplaces:
  - xsoar