Qualys | Marketplace

Details
Content
Dependencies
Version History

Qualys Vulnerability Management let's you create, run, fetch and manage reports, launch and manage vulnerability and compliance scans, and manage the host assets you want to scan for vulnerabilities and compliance

If you have a network with many assets, Qualys can detect vulnerabilities and policy compliance.

What does this content pack do?

Run scans for vulnerabilities and policy compliance.
Create reports about the scans.
Manage the hosts and assets on your network.

There are several playbooks in this pack. Each playbook launches a report or scan and fetches it when it is ready.

Authentication

Qualys Vulnerability Management uses basic authentication. You'll need your Qualys login credentials to use this integration.
Qualys user accounts that have been enabled with VIP two-factor authentication can be used with the Qualys API, however two-factor authentication will not be used when making API requests. Two-factor authentication is only supported when logging into the Qualys GUI.

Integrations

Name	Description
Qualys (Deprecated)	Deprecated. Use Qualys v2 instead.
Qualys v2	Qualys Vulnerability Management lets you create, run, fetch and manage reports, launch and manage vulnerability and compliance scans, and manage the host assets you want to scan for vulnerabilities and compliance.

Automations

Name	Description
QualysCreateIncidentFromReport	Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID). Duplicate incidents are not created for the same asset ID and QID.

Playbooks

Name	Description
Launch And Fetch Patch Report - Qualys	Launches a patch report and fetches the report when it's ready.
Launch And Fetch Compliance Report - Qualys	Launches a compliance report and fetches the report when it's ready.
Launch And Fetch PC Scan - Qualys	Launches a PC scan and fetches the scan when it's ready.
Launch And Fetch Compliance Policy Report - Qualys	Launches a compliance policy report and then fetches the report when it's ready.
Launch And Fetch VM Scan - Qualys	Launches a scan and fetches the scan when it's ready.
Launch And Fetch Remediation Report - Qualys	Launches a remediation report and fetches the report when it's ready.
Launch And Fetch Scan Based Findings Report - Qualys	Launches a scan based report and fetcesh the report when it's ready.
Vulnerability Management - Qualys (Job) - V2	Use the latest Qualys report to manage vulnerabilities. This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities. The incidents are created from the latest version of the report determined by the report timestamp. You can define the minimum severity (minSeverity) that incidents are created for. Duplicate incidents are not created for the same asset ID and QID. This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation. For this series of playbooks to run successfully, create a Job and do the following: Assign this playbook to the Job Enter the Qualys XML report name into the "Details" field Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook.
Launch And Fetch Scheduled Report - Qualys	Launches a scheduled report and fetches the report when it's ready.
Launch And Fetch Map Report - Qualys	Launches a map scan report and fetches the report when it's ready.
Vulnerability Management - Qualys (Job)	Use the latest Qualys report to manage vulnerabilities. This playbook runs as a job, and by default creates incidents of type "Vulnerability" based on assets and vulnerabilities. The incidents are created from the latest version of the report determined by the report timestamp. You can define the minimum severity (minSeverity) that incidents are created for. Duplicate incidents are not created for the same asset ID and QID. This playbook is a part of a series of playbooks for Qualys vulnerability management and remediation. For this series of playbooks to run successfully, create a Job and do the following: Assign this playbook to the Job Enter the Qualys XML report name into the "Details" field Associate the "Vulnerability" type incident to the "Vulnerability Handling - Qualys" playbook.
Launch And Fetch Host Based Findings Report - Qualys	Launches a host based report and fetches the report when it's ready.

Integrations

Name	Description
Qualys (Deprecated)	Deprecated. Use Qualys v2 instead.
Qualys v2	Qualys Vulnerability Management lets you create, run, fetch and manage reports, launch and manage vulnerability and compliance scans, and manage the host assets you want to scan for vulnerabilities and compliance.

Automations

Name	Description
QualysCreateIncidentFromReport	Create incidents from a Qualys report (XML), based on the Qualys asset ID and vulnerability ID (QID). Duplicate incidents are not created for the same asset ID and QID.

Playbooks

Name	Description
Launch And Fetch Patch Report - Qualys	Launches a patch report and fetches the report when it's ready.
Launch And Fetch Compliance Report - Qualys	Launches a compliance report and fetches the report when it's ready.
Launch And Fetch PC Scan - Qualys	Launches a PC scan and fetches the scan when it's ready.
Launch And Fetch Compliance Policy Report - Qualys	Launches a compliance policy report and then fetches the report when it's ready.
Launch And Fetch VM Scan - Qualys	Launches a scan and fetches the scan when it's ready.
Launch And Fetch Remediation Report - Qualys	Launches a remediation report and fetches the report when it's ready.
Launch And Fetch Scan Based Findings Report - Qualys	Launches a scan based report and fetcesh the report when it's ready.
Launch And Fetch Scheduled Report - Qualys	Launches a scheduled report and fetches the report when it's ready.
Launch And Fetch Map Report - Qualys	Launches a map scan report and fetches the report when it's ready.
Launch And Fetch Host Based Findings Report - Qualys	Launches a host based report and fetches the report when it's ready.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (31)

Pack Name	Pack By
FortiGate	By: Cortex XSOAR
VulnDB	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
ARIAPacketIntelligence	By: ARIA Cybersecurity Solutions
F5 Silverline	By: Cortex XSOAR
Rapid7 InsightVM	By: Cortex XSOAR
Slack	By: Cortex XSOAR
VirusTotal - Private API (Deprecated)	By: VirusTotal
Cisco Secure Cloud Analytics (Stealthwatch Cloud)	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
Akamai WAF	By: Cortex XSOAR
Cisco ASA	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Check Point Firewall	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Kenna	By: Cortex XSOAR
Signal Sciences WAF	By: Cortex XSOAR
Cisco Firepower	By: Cortex XSOAR
CVE Search	By: Cortex XSOAR
ThreatX	By: Cortex XSOAR
Image OCR	By: Cortex XSOAR
Cylance Protect	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Google Maps	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Cisco Umbrella Investigate	By: Cortex XSOAR
Sophos XG Firewall	By: Cortex XSOAR

1.2.1 - 4220433 (December 15, 2022)

Integrations

Qualys v2

Updated the Docker image to: demisto/python3:3.10.9.40422.
Added 4 commands:
- qualys-asset-tag-create
- qualys-asset-tag-update
- qualys-asset-tag-list
- qualys-asset-tag-delete
Added support for the following arguments in the qualys-schedule-scan-update and qualys-schedule-scan-create commands.
- target_from
- tag_include_selector
- tag_exclude_selector
- tag_set_by
- tag_set_include
- tag_set_exclude
- use_ip_nt_range_tags_include
- use_ip_nt_range_tags_exclude

Related pull requests:
- 22415

Download

1.2.0 - 4072273 (November 21, 2022)

Integrations

Qualys v2

Command qualys-schedule-scan-create: Added optional arguments ip_network_id, option_id and end_after
Updated the Docker image to: demisto/python3:3.10.8.37233.

Related pull requests:
- 21896
- 21594

Download

1.1.0 - 3383556 (August 2, 2022)

Integrations

Qualys v2

Added the qualys-update-unix-record command.
Updated the Docker image to: demisto/python3:3.10.5.31928.

Related pull requests:
- 20142
- 20347

Download

1.0.19 - 2941201 (May 18, 2022)

Scripts

QualysCreateIncidentFromReport

Fixed an issue where XML reports were not parsed properly to create an incident.

Download

1.0.18 - 2927997 (May 16, 2022)

Integrations

Qualys v2

Fixed an issue where qualys-host-list-detection command failed to retrieve the information.
Updated the Docker image to: demisto/python3:3.10.4.29342.

Download

1.0.17 - R2811376 (April 24, 2022)

Integrations

Qualys v2

Command qualys-schedule-scan-update: Added optional arguments target_from and iscanner_name
Updated docker image to demisto/python3:3.10.1.27636

Playbooks

Vulnerability Management - Qualys (Job) - V2

Maintenance and stability enhancement.

Download

1.0.16 - R2507216 (March 3, 2022)

Integrations

Qualys v2

Added 9 commands:

qualys-host-list-detection
qualys-host-update
qualys-asset-group-add
qualys-asset-group-edit
qualys-asset-group-delete
qualys-schedule-scan-create
qualys-schedule-scan-update
qualys-schedule-scan-delete
qualys-time-zone-code

Download

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	June 30, 2020
Last Release	December 15, 2022

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.