AnsweredAssumed Answered

How should you evaluate 'tags' via the API?

Question asked by Taka Murai on Jan 30, 2017
Latest reply on Feb 3, 2017 by Jeff Leggett

What I am wanting to do is create a scan through the API given some IP addresses.

 

Using the API, I create tags using the xml document template.

The tag is created successfully and I am returned the xml output for it, including the tag ID.

I create this tag using the "NETWORK_RANGE_ENHANCED" as the ruletype and put the IP's into the range as the by replacing {IPS}:

<?xml version="1.0" encoding="UTF-8" ?>
<ServiceRequest>
   <data>
     <Tag>
        <name>{NAME}</name>
        <parentTagId>{PARENT_TAG}</parentTagId>
        <ruleText>&lt;RANGES&gt;&lt;RANGE network=&quot;{NETWORK}&quot; type=&quot;IP&quot;&gt;{IPS}&lt;/RANGE&gt;&lt;/RANGES&gt;</ruleText>
        <ruleType>NETWORK_RANGE_ENHANCED</ruleType>
        <color>#654321</color>
    </Tag>
  </data>
</ServiceRequest>

I am having trouble getting this tag to populate with the correct asset.

 

I have tried calling "qps/rest/2.0/evaluate/am/tag/" and evaluating ALL 'NETWORK_RANGE_ENHANCED'  ruletypes as well as trying to evaluate the tag by the tag ID calling 'qps/rest/2.0/evaluate/am/tag/{ID}'

 

Am I missing a step? Is there a better way to do this?

 

FYI when I try and create the scan, I get the error saying there's no assets associated with the tag. The assets do show up when I search for them on the web portal.

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "https://qualysapi.qg2.apps.qualys.com/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
  <RESPONSE>
    <DATETIME>2017-01-31T06:26:53Z</DATETIME>
    <CODE>999</CODE>
    <TEXT>No scan targets/assets resolved from the tags</TEXT>
  </RESPONSE>
</SIMPLE_RETURN>

Outcomes