🔒 Qualys scan Slack report subworkflow
⚡ 1,255 views · 🔒 SecOps & Security Automation
Description
Introducing the Qualys Scan Slack Report Subworkflow—a robust solution designed to automate the generation and retrieval of security reports from the Qualys API.
This workflow is a sub workflow of the Qualys Slack Shortcut Bot workflow. It is triggered when someone fills out the modal popup in slack generated by the Qualys Slack Shortcut Bot.
When deploying this workflow, use the Demo Data node to simulate the data that is input via the Execute Workflow Trigger. That data flows into the Global Variables Node which is then referenced by the rest of the workflow.
It includes nodes to Fetch the Report IDs and then Launch a report, and then check the report status periodically and download the completed report, which is then posted to Slack for easy access.
For Security Operations Centers (SOCs), this workflow provides significant benefits by automating tedious tasks, ensuring timely updates, and facilitating efficient data handling.
How It Works
-
Fetch Report Templates: The “Fetch Report IDs” node retrieves a list of available report templates from Qualys. This automated retrieval saves time and ensures that the latest templates are used, enhancing the accuracy and relevance of reports.
-
Convert XML to JSON: The response is converted to JSON format for easier manipulation. This step simplifies data handling, making it easier for SOC analysts to work with the data and integrate it into other tools or processes.
-
Launch Report: A POST request is sent to Qualys to initiate report generation using specified parameters like template ID and report title. Automating this step ensures consistency and reduces the chance of human error, improving the reliability of the reports generated.
-
Loop and Check Status: The workflow loops every minute to check if the report generation is complete. Continuous monitoring automates the waiting process, freeing up SOC analysts to focus on higher-priority tasks while ensuring they are promptly notified when reports are ready.
-
Download Report: Once the report is ready, it is downloaded from Qualys. Automated downloading ensures that the latest data is always available without manual intervention, improving efficiency.
-
Post to Slack: The final report is posted to a designated Slack channel for quick access. This integration with Slack ensures that the team can promptly access and review the reports, facilitating swift action and decision-making.
Get Started
- Ensure your Slack and Qualys integrations are properly set up.
- Customize the workflow to fit your specific reporting needs.
- Link to parent workflow
- Link to Vulnerability Scan Trigger
Need Help?
- Join the discussion on our Forum or check out resources on Discord!
Deploy this workflow to streamline your security report generation process, improve response times, and enhance the efficiency of your security operations.
🔗 Nodes Used
HTTP Request, Slack, Execute Workflow Trigger
📥 Import
Download workflow.json and import into n8n:
Workflow menu → Import from File