Skip to content

qualys_vmdr: Add support for Host Detection API v5.0 #16436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kcreddy wants to merge 3 commits into
base: main
Choose a base branch
from
Open

qualys_vmdr: Add support for Host Detection API v5.0 #16436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
97b6c17
Add support for Host Detection API v5.0
kcreddy Dec 9, 2025
28db9d9
update PR number.
kcreddy Dec 9, 2025
4645727
fix more alicloud fields
kcreddy Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 55 additions & 7 deletions packages/qualys_vmdr/_dev/deploy/docker/files/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
rules:
# Initial Request
- path: /api/3.0/fo/asset/host/vm/detection/
- path: /api/5.0/fo/asset/host/vm/detection/
methods: ['GET']
query_params:
action: list
Expand All @@ -22,7 +22,7 @@ rules:
# Response only has host.id = [1,2] because of truncation limit
body: |-
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE HOST_LIST_VM_DETECTION_OUTPUT SYSTEM "https://qualysapi.qualys.com/api/3.0/fo/asset/host/vm/detection/dtd/output.dtd">
<!DOCTYPE HOST_LIST_VM_DETECTION_OUTPUT SYSTEM "https://qualysapi.qualys.com/api/5.0/fo/asset/host/vm/detection/dtd/output.dtd">
<HOST_LIST_VM_DETECTION_OUTPUT>
<RESPONSE>
<DATETIME>2023-07-03T06:51:41Z</DATETIME>
Expand Down Expand Up @@ -50,6 +50,7 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>3</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
linux-cloud-tools-4.4.0 1074-aws_4.4.0-1074.84 1092
linux-aws-tools-4.4.0 1074_4.4.0-1074.84 1092
Expand All @@ -59,6 +60,13 @@ rules:
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
Comment on lines +63 to +64
Copy link
Contributor Author

@kcreddy kcreddy Dec 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Samples values taken from documentation here, as I couldn't get them from live data.
cc: @clement-fouque

<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
Copy link
Contributor Author

@kcreddy kcreddy Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I couldn't find possible values for TRURISK_ELIMINATION_STATUS in live data or documentation.
@clement-fouque, can you confirm if this value makes sense?

<QDS severity="LOW">35</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="CVSS"><![CDATA[7.7]]></QDS_FACTOR>
Expand All @@ -81,11 +89,19 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>5</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
google-chrome-stable 130.0.6723.58-1 130.0.6723.69-1]]></RESULTS>
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
<QDS severity="CRITICAL">95</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="RTI"><![CDATA[local]]></QDS_FACTOR>
Expand Down Expand Up @@ -132,6 +148,7 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>3</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
linux-cloud-tools-4.4.0 1074-aws_4.4.0-1074.84 1092
linux-aws-tools-4.4.0 1074_4.4.0-1074.84 1092
Expand All @@ -141,6 +158,13 @@ rules:
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
<QDS severity="LOW">35</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="CVSS"><![CDATA[7.7]]></QDS_FACTOR>
Expand All @@ -163,6 +187,7 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>5</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
linux-image-4.15.0 1027-aws_4.15.0-1126.135 1047
linux-headers-4.15.0 1027-aws_4.15.0-1126.135 1047
Expand All @@ -171,6 +196,13 @@ rules:
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
<QDS severity="CRITICAL">95</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="RTI"><![CDATA[local]]></QDS_FACTOR>
Expand Down Expand Up @@ -198,12 +230,12 @@ rules:
<WARNING>
<CODE>1980</CODE>
<TEXT>1000 record limit exceeded. Use URL to get next batch of results.</TEXT>
<URL><![CDATA[http://{{ env "SERVER_ADDRESS" }}/api/3.0/fo/asset/host/vm/detection/?action=list&show_igs=1&host_metadata=all&show_qds=1&show_qds_factors=1&truncation_limit=2&ids=3&show_cloud_tags=1]]></URL>
<URL><![CDATA[http://{{ env "SERVER_ADDRESS" }}/api/5.0/fo/asset/host/vm/detection/?action=list&show_igs=1&host_metadata=all&show_qds=1&show_qds_factors=1&truncation_limit=2&ids=3&show_cloud_tags=1]]></URL>
</WARNING>
</RESPONSE>
</HOST_LIST_VM_DETECTION_OUTPUT>
# Pagination request 1
- path: /api/3.0/fo/asset/host/vm/detection/
- path: /api/5.0/fo/asset/host/vm/detection/
methods: ['GET']
query_params:
action: list
Expand All @@ -225,7 +257,7 @@ rules:
x-ratelimit-remaining: ["299"]
body: |-
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE HOST_LIST_VM_DETECTION_OUTPUT SYSTEM "https://qualysapi.qualys.com/api/3.0/fo/asset/host/vm/detection/dtd/output.dtd">
<!DOCTYPE HOST_LIST_VM_DETECTION_OUTPUT SYSTEM "https://qualysapi.qualys.com/api/5.0/fo/asset/host/vm/detection/dtd/output.dtd">
<HOST_LIST_VM_DETECTION_OUTPUT>
<RESPONSE>
<DATETIME>2023-07-03T06:51:41Z</DATETIME>
Expand Down Expand Up @@ -253,11 +285,19 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>3</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
google-chrome-stable 130.0.6723.58-1 130.0.6723.69-1]]></RESULTS>
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
<QDS severity="LOW">35</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="CVSS"><![CDATA[7.7]]></QDS_FACTOR>
Expand All @@ -280,6 +320,7 @@ rules:
<TYPE>Confirmed</TYPE>
<SEVERITY>5</SEVERITY>
<SSL>0</SSL>
<CVE>CVE-2023-48161,CVE-2024-21208,CVE-2024-21210,CVE-2024-21217,CVE-2024-21235</CVE>
<RESULTS><![CDATA[Package Installed Version Required Version
linux-image-4.15.0 1027-aws_4.15.0-1126.135 1047
linux-headers-4.15.0 1027-aws_4.15.0-1126.135 1047
Expand All @@ -288,6 +329,13 @@ rules:
<STATUS>Active</STATUS>
<FIRST_FOUND_DATETIME>2021-02-05T04:50:45Z</FIRST_FOUND_DATETIME>
<LAST_FOUND_DATETIME>2024-03-08T20:15:41Z</LAST_FOUND_DATETIME>
<VULNERABILITY_DETECTION_SOURCES>Cloud Agent,Internal Scanner</VULNERABILITY_DETECTION_SOURCES>
<LATEST_VULNERABILITY_DETECTION_SOURCE>Cloud Agent</LATEST_VULNERABILITY_DETECTION_SOURCE>
<MITRE_TACTIC_NAME>lateral-movement, privilege-escalation</MITRE_TACTIC_NAME>
<MITRE_TECHNIQUE_NAME>Exploitation of Remote Services, Exploitation for Privilege Escalation</MITRE_TECHNIQUE_NAME>
<MITRE_TACTIC_ID>TA0008, TA0004</MITRE_TACTIC_ID>
<MITRE_TECHNIQUE_ID>T1210, T1068</MITRE_TECHNIQUE_ID>
<TRURISK_ELIMINATION_STATUS>FIXED</TRURISK_ELIMINATION_STATUS>
<QDS severity="CRITICAL">95</QDS>
<QDS_FACTORS>
<QDS_FACTOR name="RTI"><![CDATA[local]]></QDS_FACTOR>
Expand Down Expand Up @@ -315,12 +363,12 @@ rules:
<WARNING>
<CODE>1980</CODE>
<TEXT>2 record limit exceeded. Use URL to get next batch of results.</TEXT>
<URL><![CDATA[http://{{ env "SERVER_ADDRESS" }}/api/3.0/fo/asset/host/vm/detection/?action=list&show_igs=1&host_metadata=all&show_qds=1&show_qds_factors=1&truncation_limit=2&id_min=77777777&show_cloud_tags=1]]></URL>
<URL><![CDATA[http://{{ env "SERVER_ADDRESS" }}/api/5.0/fo/asset/host/vm/detection/?action=list&show_igs=1&host_metadata=all&show_qds=1&show_qds_factors=1&truncation_limit=2&id_min=77777777&show_cloud_tags=1]]></URL>
</WARNING>
</RESPONSE>
</HOST_LIST_VM_DETECTION_OUTPUT>
# Pagination request 2. Should returns 0 events.
- path: /api/3.0/fo/asset/host/vm/detection/
- path: /api/5.0/fo/asset/host/vm/detection/
methods: ['GET']
query_params:
action: list
Expand Down
5 changes: 5 additions & 0 deletions packages/qualys_vmdr/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "6.14.0"
changes:
- description: Add support for Host Detection API v5.0.
type: enhancement
link: https://github.com/elastic/integrations/pull/16436
- version: "6.13.0"
changes:
- description: Add cloudsecurity_cdr sub category label
Expand Down
Loading