Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
Qualys - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="qualys-jupiterone-integration-benefits">Qualys + JupiterOne Integration Benefits</h2> <ul><li>Visualize Qualys scanners and findings in the JupiterOne graph.</li> <li>Monitor Qualys findings within the alerts app.</li> <li>Monitor changes to Qualys scanners using JupiterOne alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li>JupiterOne periodically fetches Qualys scanners to update the graph.</li> <li>Write JupiterOne queries to review and monitor updates to the graph.</li> <li>Configure alerts to reduce the noise of findings.</li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>JupiterOne requires the username and password of a Qualys user that has<br> permission to access to the API. JupiterOne also requires the url of the API.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h3 data-id="in-qualys">In Qualys</h3> <p>The Qualys API requires usage of a username and password associated with a user.<br> Also, by default, trial users do not have access to the Qualys API so you must<br> request access to the API. See<br><a rel="nofollow" href="https://debug.qualys.com/qwebhelp/fo_portal/api_doc/scans/index.htm#t=get_started%2Fget_started.htm">Qualys API docs</a><br> for more information.</p> <p>After testing for quite a bit, this integration was unable to ingest host<br> findings with the built-in READER role event after adding all of the modules.<br> This may be related to parts of the Qualys "host detection" feature being<br> controlled by a license setting. Instead use the built-in MANAGER role if you do<br> not want to create a custom role. Please refer to the Troubleshooting section<br> below, if you would like to issue granular permissions to J1.</p> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Qualys</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this Qualys account<br> in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>Qualys Username</strong> of a user configured for read access.</p></li> <li>Enter the <strong>Qualys Password</strong> of a user configured for read access.</li> <li>Enter the <strong>API URL</strong> for your Qualys account.</li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h2 data-id="how-to-uninstall">How to Uninstall</h2> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>Qualys</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><h2 data-id="troubleshooting-qualys-user-credentials">Troubleshooting Qualys User Credentials</h2> <p>If your integration is not running successfully due to insufficient permissions<br> from your Qualys user, we have provided a bash script that hits the various<br> endpoints used in this integration. Using the <strong>USERNAME</strong>, <strong>PASSWORD</strong>, and<br><strong>HOSTNAME</strong> that are used in your JupiterOne Qualys Integration configuration,<br> you should be able to determine which endpoints your user does not have the<br> appropriate permissions to invoke.</p> <p>The script can be found here:<br><a rel="nofollow" href="https://github.com/JupiterOne/graph-qualys/blob/main/docs/troubleshoot-creds.sh">https://github.com/JupiterOne/graph-qualys/blob/main/docs/troubleshoot-creds.sh</a></p> <p>Please note that while you may receive a status 200 for a particular endpoint,<br> the response may contain a message indicating your lack of permissions.</p> <p>Example output:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">< HTTP/1.1 200 < X-Powered-By: Qualys:USPOD03:b3f3a819-7884-e60e-81d0-9725801da546:cbf7331a-292e-f3ed-8231-200b1fb10047 < Content-Type: application/xml < Transfer-Encoding: chunked < Vary: Accept-Encoding < Date: Fri, 14 Jan 2022 03:55:39 GMT < Server: Apache < <?xml version="1.0" encoding="UTF-8"?> <ServiceResponse xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://qualysapi.qg3.apps.qualys.com/qps/xsd/2.0/am/hostasset.xsd"> <responseCode>UNAUTHORIZED</responseCode> <responseErrorDetails> <errorMessage>You are not authorized to access the application through the API.</errorMessage> <errorResolution>If you think this is an error, please contact your account manager.</errorResolution> </responseErrorDetails> * Connection #0 to host qualysapi.qg3.apps.qualys.com left intact </ServiceResponse> </pre> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Host Detection</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_host_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Vulnerability Manager</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vulnerability_manager</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>Web App Finding</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> </tr><tr><td>Web Application Scanner</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_scanner</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vulnerability_manager</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_scanner</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_host_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">cve</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_host_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vuln</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">cve</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_finding</code></td> <td><strong>IS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vuln</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_scanner</code></td> <td><strong>IDENTIFIED</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_finding</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_web_app_scanner</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">web_app</code></td> </tr></tbody></table><h3 data-id="mapped-relationships">Mapped Relationships</h3> <p>The following mapped relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Direction</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vulnerability_manager</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*aws_instance*</code></td> <td>FORWARD</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vulnerability_manager</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*discovered_host*</code></td> <td>FORWARD</td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">qualys_vulnerability_manager</code></td> <td><strong>SCANS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">*google_compute_instance*</code></td> <td>FORWARD</td> </tr></tbody></table><h2 data-id="threatintel-mappings">ThreatIntel Mappings</h2> <p>There are two global mapping rules defined to map <code class="code codeInline" spellcheck="false" tabindex="0">ThreatIntel</code> to <code class="code codeInline" spellcheck="false" tabindex="0">Finding</code> and<br><code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability</code> entities in Qualys using <code class="code codeInline" spellcheck="false" tabindex="0">qid</code>.</p> <p>These global mappings are defined as follows:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Source Property</th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Property</th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">ThreatIntel</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qid</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Finding</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qid</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">ThreatIntel</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qid</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Vulnerability</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">qid</code></td> </tr></tbody></table> </article> </main>
.png)