Hello all,
I have recently started working with the Qualys API's. I will be requiring tips an help on the same.
Ps: I am going trough the API PDF's and the wonderful sample codes.
Basically here is what I need to do :-
The requirement is to add Ip's which are in the CSV format to Asset group and then run a MAP or a SCAN and then download the results in CSV format.
Thanks
venk
Moving to Developer community for better visibility. You'll find some API resources here.
Regards, Robert (community manager)
After playing with a few API and scripts with curl and perl. Here is my observation and API limitation
1.) Can create AG using curl - No problems
2.) Populating AG (add_host_ips=IPLIST ) is possible - with few limitations
if you have a few IP's ( but in my case I have a lot (thousands) )
No Real BULK upload say for 5K rows or 25K rows of IP/Subnet which is possible manually but not with API
Work around is to add smaller chunks one by one..which is tedious and time consuming.
2.A ) Did not see any API on deleting IP's from AG or Empty up the AG, keeping the AG name intact.
Something similar in Unix
cd AG
AG> rm -rf *
Workaround is to delete the AG and recreate but by doing so the Reports and other associated schedule is gone.
3.) Cannot schedule "MAP" with API on an AG until and unless the Domain name is specified. But manualy we can.
thanks !
/v
I there,
I believe that your community post is related to another discussion we have in parallel by email.
Did you get the information that if you do a POST for the AG API, the limit is multiple MB?
Hi Eric,
Thx for the reply. Yes I did recv the email.
when you say "the limit is multiple MB?" Do I have to split the HUGE file to a certain MB ??
The API via Curl :
asset_group.php?action=edit&title=AssetGRP&add_host_ips=$IPLIST
$IPLIST has to be a comma separated row up to 200KB or can It exceed up to a few MB ?
Thanks
/v
Eric, which discussion are you referencing? Please post in this thread, and thanks!
Below is a sample using Python and qualysconnect. It does the following:
import csv
from qualysconnect.util import build_v1_connector, build_v2_session
from lxml import objectify
# Log in to both QualysGuard APIs.
qgc = build_v1_connector()
qgs = build_v2_session()
qgs.connect()
# Read in CSV file, one IP address per line.
ip_file = csv.reader(open('community add from csv file, scan, download report.csv', 'rb'))
ips = []
for row in ip_file:
ips.append(row)
# ips contains all ip addresses. Convert to string and delimit with comma.
ips_param = ','.join(map(str,ips))
# Add IPs to asset group.
qg_response = qgc.request('asset_group.php?action=edit&title=Asset_Group_Name&save_report=yes&add_host_ips=%s' % (ips_param))
# Run a scan.
qg_response = qgc.request('scan.php?scan_title=Automatic+Scan&asset_groups=Asset_Group_Name&default_scanner=1')
# Wait until scan completes.
# Scan completed. Find scan reference value.
tree = objectify.fromstring(qg_response)
scan_ref = tree.attrib['value']
# Download CSV scan report.
qg_scan_report = qgs.request('scan/', 'action=fetch&scan_ref=%s' % (scan_ref))
f_csv = open('scan_report.csv', 'w')
f_csv.write(qg_scan_report)
f_csv.close()
The CSV this script reads from is below:
10.10.10.25 10.10.10.2
I've attached both to this post.
Hi Parag,
Thanks for the reply. We have this situation ..( Needed for Map and NOT for Scan)
1.) Huge file a combination of IP and subnets 25 - 30 K rows. (yes 25000 to 30000 rows.)
2.) Currently we spit them up manually up to 5K Rows each and add them in 5 or 6 different Assetgoup and run the MAP ( Manually using the GUI)
Hence the request for a Bulk upload. as Adding one by one or splitting up into smaller chunks is a pain.
Also : Cannot schedule "MAP" with API on an AG until and unless the Domain name is specified. But manualy we can.
Thanks !!
venk
Hi Venk,
Here is the workflow I would envision and that can be automated via the API:
1. create a dedicate "fake" domain for each batch of 5k row. For instance: domain1.lan, domain2.lan. Very important: make sure to use real "fake" domains that are invalid so a DNS lookup will never return anything.
2. for each domain, add the assicated netblock. For instance: domain1.lan:[192.168.0.1-192.168.10.254] etc...
3. create the asset groups as when necessare
4. add the domains to the asset groups.
5. launch the maps (or schedule them).
That should work and there is an api request for each step I can document later if you agree with this approach.
Thanks,
Eric
Hi Eric,
Decided to use the Web-GUI instead of API. GUI is much quicker and faster.
Thanks,
Venk
Hi All,
I am also trying to do automate the launch scan, generate report for WAS module via API, I have individual python scripts to launch scan, generate report, those scripts are working fine but I have to combine the individual scripts as one means after scan completes it has to generate the custom report automatically. The above sample script provided by Parag was good exapmle for VM API, I tried the same but missing the logic, I am not expert in python, could some one help me out. Below are the scripts.
Launch scan:
import lxml.objectify
from lxml.builder import E
import qualysapi
import requests
qgc = qualysapi.connect()
call = '/launch/was/wasscan'
parameters = '<ServiceRequest><data><WasScan><name>Vulnerability Scan launched from API</name><type>VULNERABILITY</type><target><webApp><id>12345</id></webApp><webAppAuthRecord><isDefault>true</isDefault></webAppAuthRecord><scannerAppliance><type>EXTERNAL</type><friendlyName>External</friendlyName></scannerAppliance></target><profile><id>12345</id></profile></WasScan></data></ServiceRequest>'
xml_output = qgc.request(call, parameters)
print xml_output
Generate Report:
import lxml.objectify
from lxml.builder import E
import qualysapi
import requests
qgc = qualysapi.connect()
call = '/create/was/report'
parameters = '<ServiceRequest><data><Report><name>Web_App_Report</name><description><![CDATA[A web application report]]></description><type>WAS_WEBAPP_REPORT</type><format>PDF</format><config><webAppReport><target><tags><included><option>ALL</option><tagList><Tag><id>12345</id></Tag></tagList></included></tags></target></webAppReport></config><template><id>12345</id></template></Report></data></ServiceRequest>'
xml_output = qgc.request(call, parameters)
print xml_output
Thats great welcome to world of Qualys.
Best Regards,
Kishore B