Qualys
Qualys WAS - Initiate Scan [Step 1 of 5]
The purpose of this example is to initiate scheduling a Web Application scan of the assets on the project scope in Qualys when a user clicks on an Action in AttackForge.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
Action:
Entities: Projects and Project
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
fallback_protocol - when an asset name doesn't have a protocol, set a default protocol e.g. https://
qualys_vm_launch_scan_flow_trigger_id - the Trigger URL for Qualys WAS - Create Web Object and Launch Scan [Step 2 of 5]
logging_level - set to "debug" for additional logging
Action 1 - Get Project(s)
Method: GET
URL: https://{{af_hostname}}/api/ss/project/{{project_id}}
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 2 - Create Web App and Launch WAS Scan
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_vm_launch_scan_flow_trigger_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Qualys VM - Initiate Project Scope Scan [Step 1 of 5]
The purpose of this example is to initiate scheduling a VM scan of the assets on the project scope in Qualys when a user clicks on an Action in AttackForge.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
Action:
Entities: Projects and Project
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
qualys_vm_scan_flow_trigger_id - the Trigger URL for Qualys VM - Launch Scan [Step 2 of 5]
logging_level - set to "debug" for additional logging
Action 1 - Get Project(s)
Method: GET
URL: https://{{af_hostname}}/api/ss/project/{{project_id}}
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 2 - Trigger Qualys VM Scan Flow
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_vm_scan_flow_trigger_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Qualys WAS - Create Web Object and Launch Scan [Step 2 of 5]
The purpose of this example is to create and launch a Web Application scan in Qualys.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
HTTP Trigger:
Method: POST
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
qualys_api_url - your Qualys API hostname e.g. qualysapi.qualys.com.
qualys_auth - Qualys credentials in
username:passwordformat.qualys_profile_id - the Qualys scan option profile ID to use.
logging_level - set to "debug" for additional logging
Action 1 - Search Existing Web Apps
Method: POST
URL: https://{{qualys_api_url}}/qps/rest/3.0/search/was/webapp
Headers:
Key = Content-Type; Type = Value; Value = text/html
Request Script:
Response Script:
Action 2 - Create Web Object
Method: POST
URL: https://{{qualys_api_url}}/qps/rest/3.0/create/was/webapp
Headers:
Key = Content-Type; Type = Value; Value = text/html
Request Script:
Response Script:
Action 3 - Launch Scan
Method: POST
URL: https://{{qualys_api_url}}/qps/rest/3.0/launch/was/wasscan
Headers:
Key = Content-Type; Type = Value; Value = text/html
Request Script:
Response Script:
Action 4 - Update Project with Scan Id
Method: PUT
URL: https://{{af_hostname}}/api/ss/project/{id}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Request Script:
Response Script:
Qualys VM - Launch Scan [Step 2 of 5]
The purpose of this example is to create and launch a VM scan in Qualys.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
HTTP Trigger:
Method: POST
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
qualys_api_url - your Qualys API hostname e.g. qualysapi.qualys.com.
qualys_auth - Qualys credentials in
username:passwordformat.qualys_option_id - the Qualys scan option profile ID to use.
scan_name_prefix - optional prefix for the scan title (defaults to "AttackForge Qualys VM Scan").
logging_level - set to "debug" for additional logging
Action 1 - Launch Qualys VM Scan
Method: POST
URL: https://{{qualys_api_url}}/api/2.0/fo/scan/
Headers:
Key = Content-Type; Type = Value; Value = application/x-www-form-urlencoded
Key = X-Requested-With; Type = Value; Value = AttackForge
Request Script:
Response Script:
Action 2 - Update Project with Scan Details
Method: PUT
URL: https://{{af_hostname}}/api/ss/project/{id}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Request Script:
Response Script:
Qualys VM & WAS - Find Active Scans to Poll Status [Step 3 of 5]
The purpose of this example is to poll the scan status for any active Qualys scans, and for any completed scans - trigger a download of the vulnerabilities.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
Schedule:
Every hour
CRON String: 0 0/1 * * *
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
qualys_vm_poll_flow_trigger_id - the Trigger URL for Qualys VM - Poll and Fetch Findings [Step 4 of 5]
qualys_was_poll_flow_trigger_id - the Trigger URL for Qualys WAS - Poll and Fetch Findings [Step 4 of 5]
logging_level - set to "debug" for additional logging
Action 1 - Get Qualys Active Scan Projects
Method: GET
URL: https://{{af_hostname}}/api/ss/projects?order=created:desc&limit=500
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Request Script:
Response Script:
Action 2 - Trigger Qualys VM Poll Flow
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_vm_poll_flow_trigger_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 3 - Trigger Qualys WAS Poll Flow
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_vm_poll_flow_trigger_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Qualys WAS - Poll and Fetch Findings [Step 4 of 5]
The purpose of this example is to export the results of a Web Application scan in Qualys.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
HTTP Trigger:
Method: POST
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
current_flow_id - the Id for this Flow in AttackForge once it's created (used for error reporting in email)
qualys_api_url - your Qualys API hostname e.g. qualysapi.qualys.com.
qualys_auth - Qualys credentials in
username:passwordformat.qualys_import_vuln_trigger_flow_id - the Trigger URL for Qualys VM & WAS - Import Vulnerabilities [Step 5 of 5]
qualys_web_base_url - your Qualys web console base URL e.g. https://qualysguard.qualys.com
admin_email - the email address to send error and alert notifications
logging_level - set to "debug" for additional logging
Action 1 - Poll WAS Scan status
Method: POST
URL: https://{{qualys_api_url}}/qps/rest/3.0/search/was/wasscan
Headers:
Key = Content-Type; Type = Value; Value = text/xml
Key = X-Requested-With; Type = Value; Value = AttackForge
Request Script:
Response Script:
Action 2 - Search Findings
Method: POST
URL: https://{{qualys_api_url}}/qps/rest/3.0/search/was/finding
Headers:
Key = Content-Type; Type = Value; Value = text/xml
Key = X-Requested-With; Type = Value; Value = AttackForge
Request Script:
Response Script:
Action 3 - Get Findings
Method: GET
URL: https:///{{qualys_api_url}}/qps/rest/3.0/get/was/finding/{id}
Headers:
Key = X-Requested-With; Type = Value; Value = AttackForge
Request Script:
Response Script:
Action 4 - Get Knowledgebase and Enrich
Method: GET
URL: https://{{qualys_api_url}}/api/4.0/fo/knowledge_base/vuln/?action=list&details=All&ids={{qids}}
Headers:
Key = X-Requested-With; Type = Value; Value = AttackForge
Key = Accept; Type = Value; Value = application/xml
Request Script:
Response Script:
Action 5 - Trigger Import Flow
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_import_vuln_trigger_flow_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 6 - No Findings only - Add Note to Project
Method: POST
URL: https://{{af_hostname}}/api/ss/project/{id}/note
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = apikey
Request Script:
Response Script:
Action 7 - Update Project to Remove WAS Custom Fields
Method: PUT
URL: https://{{af_hostname}}/api/ss/project/{{id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = apikey
Request Script:
Response Script:
Action 8 - Send Email for Error Reporting
Method: POST
URL: https://{{af_hostname}}/api/ss/email
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = apikey
Request Script:
Response Script:
Qualys VM - Poll and Fetch Findings [Step 4 of 5]
The purpose of this example is to export the results of a VM scan in Qualys.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
HTTP Trigger:
Method: POST
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
current_flow_id - the Id for this Flow in AttackForge once it's created (used for error reporting in email)
qualys_api_url - your Qualys API hostname e.g. qualysapi.qualys.com.
qualys_auth - Qualys credentials in
username:passwordformat.qualys_import_vuln_trigger_flow_id - the Trigger URL for Qualys VM & WAS - Import Vulnerabilities [Step 5 of 5]
qualys_vm_launch_scan_flow_trigger_id - the Trigger URL for Qualys VM - Launch Scan [Step 2 of 5]
qualys_web_base_url - your Qualys web console base URL e.g. https://qualysguard.qualys.com
admin_email - the email address to send error and alert notifications
logging_level - set to "debug" for additional logging
Action 1 - Poll Scan Status
Method: GET
URL: https://{{qualys_api_url}}/api/2.0/fo/scan/vm/summary/?action=list&scan_reference=scan/{{scan_ref}}
Headers:
Key = X-Requested-With; Type = Value; Value = HTTP
Request Script:
Response Script:
Action 2 - If Interrupted - Get Project Assets
Method: GET
URL: https://{{af_hostname}}/api/ss/project/{{id}}
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 3 - Re-launch Interrupted Scan
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_launch_scan_flow_trigger_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 4 - Fetch Scan Result
Method: POST
URL: https://{{qualys_api_url}}/api/3.0/fo/scan/?action=fetch&scan_ref=scan/{{scan_ref}}&output_format=json
Headers:
Key = X-Requested-With; Type = Value; Value = HTTP
Request Script:
Response Script:
Action 5 - Fetch Knowledgebase
Method: GET
URL: https://{{qualys_api_url}}/api/4.0/fo/knowledge_base/vuln/?action=list&details=All&ids={{qids_param}}
Headers:
Key = X-Requested-With; Type = Value; Value = HTTP
Request Script:
Response Script:
Action 6 - Fetch Knowledgebase QVS
Method: GET
URL: https://{{qualys_api_url}}/api/2.0/fo/knowledge_base/qvs/?action=list&details=All&cve={{cves_param}}
Headers:
Key = X-Requested-With; Type = Value; Value = HTTP
Request Script:
Response Script:
Action 7 - Trigger Import Vulnerabilities Flow
Method: POST
URL: https://{{af_hostname}}/api/flows/{{qualys_import_vuln_trigger_flow_id}}
Headers:
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 8 - No Findings - Add Note to Project
Method: POST
URL: https://{{af_hostname}}/api/ss/project/{id}/note
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 9 - Clear Active Scan
Method: PUT
URL: https://{{af_hostname}}/api/ss/project/{id}
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Action 10 - Send Report Email
Method: POST
URL: https://{{af_hostname}}/api/ss/email
Headers:
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Key = Content-Type; Type = Value; Value = application/json
Request Script:
Response Script:
Qualys VM & WAS - Import Vulnerabilities [Step 5 of 5]
The purpose of this example is to import vulnerabilities from a Qualys Web Application or VM scan.
This example Flow can be downloaded from our Flows GitHub Repository and imported into your AttackForge.
Initial Set Up
HTTP Trigger:
Method: POST
Secrets:
af_hostname - your AttackForge tenant hostname e.g. demo.attackforge.com
af_key - your AttackForge user API key
import_to_library - optional AttackForge Writeup library. Must be either "Imported Vulnerabilities", "Main Vulnerabilities", "Project Vulnerabilities" or key for a custom library (if custom libraries are used).
logging_level - set to "debug" for additional logging
Action 1 - Validate Transform Group
Script:
Action 2 - Import Vulnerabilities
Method: POST
URL: https://{{af_hostname}}/api/ss/vulnerability
Headers:
Key = Content-Type; Type = Value; Value = application/json
Key = X-SSAPI-KEY; Type = Secret; Value = af_key
Request Script:
Response Script:
Last updated