{ "name": "qualys_vmdr", "title": "Qualys VMDR", "version": "6.18.0", "release": "ga", "description": "Collect data from Qualys VMDR platform with Elastic Agent.", "type": "integration", "download": "/epr/qualys_vmdr/qualys_vmdr-6.18.0.zip", "path": "/package/qualys_vmdr/6.18.0", "icons": [ { "src": "/img/qualys-vmdr-logo.svg", "path": "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-logo.svg", "title": "Qualys VMDR logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.11 || ^9.2.5" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "vulnerability_management", "vulnerability_workflow", "cloudsecurity_cdr" ], "signature_path": "/epr/qualys_vmdr/qualys_vmdr-6.18.0.zip.sig", "format_version": "3.4.0", "readme": "/package/qualys_vmdr/6.18.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/qualys-vmdr-asset-host-detection-dashboard.png", "path": "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-asset-host-detection-dashboard.png", "title": "Qualys VMDR Asset Host Detection Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/qualys-vmdr-knowledge-base-dashboard.png", "path": "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-knowledge-base-dashboard.png", "title": "Qualys VMDR Knowledge Base Dashboard Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/qualys-vmdr-user-activity-dashboard.png", "path": "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-user-activity-dashboard.png", "title": "Qualys VMDR User Activity Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/qualys_vmdr/6.18.0/LICENSE.txt", "/package/qualys_vmdr/6.18.0/changelog.yml", "/package/qualys_vmdr/6.18.0/manifest.yml", "/package/qualys_vmdr/6.18.0/validation.yml", "/package/qualys_vmdr/6.18.0/docs/README.md", "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-asset-host-detection-dashboard.png", "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-knowledge-base-dashboard.png", "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-logo.svg", "/package/qualys_vmdr/6.18.0/img/qualys-vmdr-user-activity-dashboard.png", "/package/qualys_vmdr/6.18.0/kibana/tags.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/manifest.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/sample_event.json", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/manifest.yml", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/sample_event.json", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/manifest.yml", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/sample_event.json", "/package/qualys_vmdr/6.18.0/kibana/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd.json", "/package/qualys_vmdr/6.18.0/kibana/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892.json", "/package/qualys_vmdr/6.18.0/kibana/dashboard/qualys_vmdr-89c63c80-a8eb-436d-9da2-a6c988fe8f0a.json", "/package/qualys_vmdr/6.18.0/kibana/search/qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892.json", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/base-fields.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/beats.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/ecs.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/fields.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/package.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/resource.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/fields/vulnerability.yml", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/fields/base-fields.yml", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/fields/beats.yml", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/fields/fields.yml", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/fields/base-fields.yml", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/fields/beats.yml", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/fields/fields.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/transform.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/agent/stream/input.yml.hbs", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml", "/package/qualys_vmdr/6.18.0/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/pipeline_knowledge_base.yml", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/agent/stream/input.yml.hbs", "/package/qualys_vmdr/6.18.0/data_stream/knowledge_base/elasticsearch/ingest_pipeline/default.yml", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/agent/stream/cel.yml.hbs", "/package/qualys_vmdr/6.18.0/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/base-fields.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/beats.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs-overridden.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/fields.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/package.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/resource.yml", "/package/qualys_vmdr/6.18.0/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml" ], "policy_templates": [ { "name": "qualys_vmdr", "title": "Qualys VMDR data", "description": "Collect Qualys VMDR data.", "inputs": [ { "type": "cel", "vars": [ { "name": "username", "type": "text", "title": "Username", "description": "Username for the Qualys VMDR.", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "Password for the Qualys VMDR.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Qualys VMDR data via API", "description": "Collecting Qualys VMDR via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "qualys_vmdr.asset_host_detection", "title": "Collect Asset Host Detection data from Qualys VMDR platform.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Qualys Server API.", "multi": false, "required": true, "show_user": true }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. User can choose interval as per their plan mentioned in [Qualys API Limits](https://www.qualys.com/docs/qualys-api-limits.pdf). Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "4h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Qualys Server API. This parameter specifies the truncation limit for the response. Specify 0 for no truncation limit.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "host_qid_list_query_limit", "type": "integer", "title": "Vulnerability knowledge base list query limit", "description": "Limit for the number of knowledge base IDs included in enrichment requests. This should be lowered if requests to the `/api/3.0/fo/knowledge_base/vuln/` endpoint return 414 status codes.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Give a timeout of more than 1 minute when retrieving data which is more than 15 days old. Supported time units are ns, us, ms, s, m, h. Requests may take significant time, so short timeouts are not recommended.", "multi": false, "required": true, "show_user": false, "default": "10m" }, { "name": "input_parameters", "type": "text", "title": "Input Parameters", "description": "Input Parameters for the URL. param1=value¶m2=value¶m3=....*", "multi": false, "required": false, "show_user": true, "default": "" }, { "name": "cloud_data", "type": "select", "title": "Cloud Metadata Source", "description": "What source to use to populate `cloud.*` fields.", "multi": false, "required": true, "show_user": false, "default": "both" }, { "name": "show_igs", "type": "bool", "title": "Enable Information Gathered Detections", "description": "By default, Qualys API only includes detection records with `Confirmed` and `Potential` vulnerabilities. When this option is enabled, the Qualys API sends detections of type `Info` in addition to `Confirmed` and `Potential` vulnerabilities.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "enable_deduplication", "type": "bool", "title": "Enable Data Deduplication", "description": "By default, each sync interval will ingest all detected vulnerabilities. \nHowever, if deduplication is enabled, any existing vulnerabilities in the current backing index will not be duplicated. \nThe presence of a vulnerability in the backing index is determined by computing a checksum of the event contents and checking if that checksum already exists in Elasticsearch.\n", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "qualys_vmdr-asset_host_detection" ] }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve qualys_vmdr.asset_host_detection fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "input.yml.hbs", "title": "Asset Host Detection data", "description": "Collect Asset Host Detection data from Qualys VMDR platform.", "enabled": true, "ingestion_method": "API" } ], "package": "qualys_vmdr", "path": "asset_host_detection" }, { "type": "logs", "dataset": "qualys_vmdr.knowledge_base", "title": "Collect Knowledge Base data from Qualys VMDR platform.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Qualys Server API.", "multi": false, "required": true, "show_user": true }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Knowledge Base data from Qualys VMDR. Supported units for this parameter are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "120h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. User can choose interval as per their plan mentioned in [Qualys API Limits](https://www.qualys.com/docs/qualys-api-limits.pdf). Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "6h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Give a timeout of more than 1 minute when retrieving data which is more than 15 days old. Supported time units are ns, us, ms, s, m, h. Requests may take significant time, so short timeouts are not recommended.", "multi": false, "required": true, "show_user": false, "default": "10m" }, { "name": "input_parameters", "type": "text", "title": "Input Parameters", "description": "Input Parameters for the URL. param1=value¶m2=value¶m3=....*", "multi": false, "required": false, "show_user": true, "default": "" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "qualys_vmdr-knowledge_base" ] }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve qualys_vmdr.knowledge_base fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "input.yml.hbs", "title": "Knowledge Base data", "description": "Collect Knowledge Base data from Qualys VMDR platform.", "enabled": false, "ingestion_method": "API" } ], "package": "qualys_vmdr", "path": "knowledge_base" }, { "type": "logs", "dataset": "qualys_vmdr.user_activity", "title": "Collect User Activity Log data from Qualys VMDR platform.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Qualys Server API.", "multi": false, "required": true, "show_user": true }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the User Activity log data from Qualys VMDR. Supported units for this parameter are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. User can choose interval as per their plan mentioned in [Qualys API Limits](https://www.qualys.com/docs/qualys-api-limits.pdf). Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "4h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Qualys Server API. This parameter specifies the truncation limit for the response. Specify 0 for no truncation limit.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Give a timeout of more than 1 minute when retrieving data which is more than 15 days old. Supported time units are ns, us, ms, s, m, h. Requests may take significant time, so short timeouts are not recommended.", "multi": false, "required": true, "show_user": false, "default": "10m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "qualys_vmdr-user_activity" ] }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve qualys_vmdr.user_activity fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "cel.yml.hbs", "title": "User Activity Log", "description": "Collect User Activity Log data from Qualys VMDR platform.", "enabled": false, "ingestion_method": "API" } ], "package": "qualys_vmdr", "path": "user_activity" } ] }