Skip to content

Commit c0cf6f2

Browse files
kcreddykcreddy
authored
qualys_vmdr: Add latest transform for Asset Host Detections (#13455)
Adds a latest transform for vulnerabilities which allows data from Qualys VMDR to be displayed in Elastic Security CNVM workflow. Ref: #11673
1 parent 8db8e05 commit c0cf6f2

File tree

12 files changed

+755
-71
lines changed

12 files changed

+755
-71
lines changed

‎packages/qualys_vmdr/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "6.6.0"
3+
changes:
4+
- description: Add latest transform for Host Detections.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13455
27
- version: "6.5.0"
38
changes:
49
- description: Update to v3 API for asset and knowledge_base data streams.

‎packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json‎

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
2-
"@timestamp": "2025-02-04T13:41:14.474Z",
2+
"@timestamp": "2025-04-08T09:44:10.009Z",
33
"agent": {
4-
"ephemeral_id": "fdc43b03-8e0f-41f9-a377-5d8820668401",
5-
"id": "ddaa4708-4109-4d2b-bbca-dc3fa4b8bfb5",
6-
"name": "elastic-agent-15814",
4+
"ephemeral_id": "7e54ee7b-229e-4d8a-b4db-021a9755f3b6",
5+
"id": "a6b5dc9a-fdd8-48e8-93df-bd12211c464a",
6+
"name": "elastic-agent-13786",
77
"type": "filebeat",
8-
"version": "8.16.0"
8+
"version": "8.18.0"
99
},
1010
"cloud": {
1111
"instance": {
@@ -14,25 +14,25 @@
1414
},
1515
"data_stream": {
1616
"dataset": "qualys_vmdr.asset_host_detection",
17-
"namespace": "49337",
17+
"namespace": "92309",
1818
"type": "logs"
1919
},
2020
"ecs": {
2121
"version": "8.11.0"
2222
},
2323
"elastic_agent": {
24-
"id": "ddaa4708-4109-4d2b-bbca-dc3fa4b8bfb5",
25-
"snapshot": false,
26-
"version": "8.16.0"
24+
"id": "a6b5dc9a-fdd8-48e8-93df-bd12211c464a",
25+
"snapshot": true,
26+
"version": "8.18.0"
2727
},
2828
"event": {
2929
"agent_id_status": "verified",
3030
"category": [
31-
"host"
31+
"vulnerability"
3232
],
3333
"dataset": "qualys_vmdr.asset_host_detection",
3434
"id": "11111111",
35-
"ingested": "2025-02-04T13:41:17Z",
35+
"ingested": "2025-04-08T09:44:12Z",
3636
"kind": "alert",
3737
"original": "{\"DETECTION_LIST\":{\"AFFECT_RUNNING_KERNEL\":\"0\",\"FIRST_FOUND_DATETIME\":\"2021-02-05T04:50:45Z\",\"IS_DISABLED\":\"0\",\"IS_IGNORED\":\"0\",\"LAST_FIXED_DATETIME\":\"2022-12-14T06:52:57Z\",\"LAST_FOUND_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_PROCESSED_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_TEST_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_UPDATE_DATETIME\":\"2024-03-08T20:15:41Z\",\"QDS\":{\"#text\":\"35\",\"severity\":\"LOW\"},\"QDS_FACTORS\":{\"QDS_FACTOR\":[{\"#text\":\"7.7\",\"name\":\"CVSS\"},{\"#text\":\"v3.x\",\"name\":\"CVSS_version\"},{\"#text\":\"0.00232\",\"name\":\"epss\"},{\"#text\":\"AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"name\":\"CVSS_vector\"}]},\"QID\":\"101\",\"RESULTS\":\"Package\\tInstalled Version\\tRequired Version\\nlinux-cloud-tools-4.4.0\\t1074-aws_4.4.0-1074.84\\t1092\\nlinux-aws-tools-4.4.0\\t1074_4.4.0-1074.84\\t1092\\nlinux-aws-headers-4.4.0\\t1074_4.15.0-1126.135\\t1092\\nlinux-tools-4.4.0\\t1074-aws_4.4.0-1074.84\\t1092\\nlinux-aws-cloud-tools-4.4.0\\t1074_4.4.0-1074.84\\t1092\",\"SEVERITY\":\"3\",\"SSL\":\"0\",\"STATUS\":\"Active\",\"TIMES_FOUND\":\"5393\",\"TYPE\":\"Confirmed\",\"UNIQUE_VULN_ID\":\"11111111\"},\"DNS\":\"adfssrvr.adfs.local\",\"DNS_DATA\":{\"DOMAIN\":\"adfs.local\",\"FQDN\":\"adfssrvr.adfs.local\",\"HOSTNAME\":\"adfssrvr\"},\"ID\":\"1\",\"IP\":\"10.50.2.111\",\"KNOWLEDGE_BASE\":{\"CATEGORY\":\"CGI\",\"CONSEQUENCE\":\"Depending on the vulnerability being exploited, an unauthenticated remote attacker could conduct cross-site scripting, clickjacking or MIME-type sniffing attacks.\",\"CVE_LIST\":[\"CVE-2022-31629\",\"CVE-2022-31628\"],\"DIAGNOSIS\":\"This QID reports the absence of the following\",\"DISCOVERY\":{\"REMOTE\":\"1\"},\"LAST_SERVICE_MODIFICATION_DATETIME\":\"2023-06-29T12:20:46Z\",\"PATCHABLE\":\"0\",\"PCI_FLAG\":\"1\",\"PUBLISHED_DATETIME\":\"2017-06-05T21:34:49Z\",\"QID\":\"101\",\"SEVERITY_LEVEL\":\"2\",\"SOFTWARE_LIST\":{\"SOFTWARE\":[{\"PRODUCT\":\"None\",\"VENDOR\":\"multi-vendor\"}]},\"SOLUTION\":\"\\u003cB\\u003eNote:\\u003c/B\\u003e To better debug the results of this QID\",\"THREAT_INTELLIGENCE\":{\"THREAT_INTEL\":[{\"id\":\"8\"}]},\"TITLE\":\"HTTP Security Header Not Detected\",\"VULN_TYPE\":\"Vulnerability\"},\"LAST_PC_SCANNED_DATE\":\"2023-06-28T09:58:12Z\",\"LAST_SCAN_DATETIME\":\"2023-07-03T06:25:17Z\",\"LAST_VM_SCANNED_DATE\":\"2023-07-03T06:23:47Z\",\"LAST_VM_SCANNED_DURATION\":\"1113\",\"NETBIOS\":\"ADFSSRVR\",\"OS\":\"Windows 2016/2019/10\",\"TRACKING_METHOD\":\"IP\"}",
3838
"type": [
@@ -140,29 +140,33 @@
140140
"last_vm_scanned_duration": 1113,
141141
"netbios": "ADFSSRVR",
142142
"os": "Windows 2016/2019/10",
143-
"package_nested": {
144-
"fixed_version": [
145-
"1092",
146-
"1092",
147-
"1092",
148-
"1092",
149-
"1092"
150-
],
151-
"name": [
152-
"linux-cloud-tools-4.4.0",
153-
"linux-aws-tools-4.4.0",
154-
"linux-aws-headers-4.4.0",
155-
"linux-tools-4.4.0",
156-
"linux-aws-cloud-tools-4.4.0"
157-
],
158-
"version": [
159-
"1074-aws_4.4.0-1074.84",
160-
"1074_4.4.0-1074.84",
161-
"1074_4.15.0-1126.135",
162-
"1074-aws_4.4.0-1074.84",
163-
"1074_4.4.0-1074.84"
164-
]
165-
},
143+
"package_nested": [
144+
{
145+
"fixed_version": "1092",
146+
"name": "linux-cloud-tools-4.4.0",
147+
"version": "1074-aws_4.4.0-1074.84"
148+
},
149+
{
150+
"fixed_version": "1092",
151+
"name": "linux-aws-tools-4.4.0",
152+
"version": "1074_4.4.0-1074.84"
153+
},
154+
{
155+
"fixed_version": "1092",
156+
"name": "linux-aws-headers-4.4.0",
157+
"version": "1074_4.15.0-1126.135"
158+
},
159+
{
160+
"fixed_version": "1092",
161+
"name": "linux-tools-4.4.0",
162+
"version": "1074-aws_4.4.0-1074.84"
163+
},
164+
{
165+
"fixed_version": "1092",
166+
"name": "linux-aws-cloud-tools-4.4.0",
167+
"version": "1074_4.4.0-1074.84"
168+
}
169+
],
166170
"tracking_method": "IP",
167171
"vulnerability": {
168172
"affect_running_kernel": "0",
@@ -276,4 +280,4 @@
276280
"severity": "high",
277281
"title": "HTTP Security Header Not Detected"
278282
}
279-
}
283+
}

‎packages/qualys_vmdr/docs/README.md‎

Lines changed: 38 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -125,13 +125,13 @@ An example event for `asset_host_detection` looks as following:
125125

126126
```json
127127
{
128-
"@timestamp": "2025-02-04T13:41:14.474Z",
128+
"@timestamp": "2025-04-08T09:44:10.009Z",
129129
"agent": {
130-
"ephemeral_id": "fdc43b03-8e0f-41f9-a377-5d8820668401",
131-
"id": "ddaa4708-4109-4d2b-bbca-dc3fa4b8bfb5",
132-
"name": "elastic-agent-15814",
130+
"ephemeral_id": "7e54ee7b-229e-4d8a-b4db-021a9755f3b6",
131+
"id": "a6b5dc9a-fdd8-48e8-93df-bd12211c464a",
132+
"name": "elastic-agent-13786",
133133
"type": "filebeat",
134-
"version": "8.16.0"
134+
"version": "8.18.0"
135135
},
136136
"cloud": {
137137
"instance": {
@@ -140,25 +140,25 @@ An example event for `asset_host_detection` looks as following:
140140
},
141141
"data_stream": {
142142
"dataset": "qualys_vmdr.asset_host_detection",
143-
"namespace": "49337",
143+
"namespace": "92309",
144144
"type": "logs"
145145
},
146146
"ecs": {
147147
"version": "8.11.0"
148148
},
149149
"elastic_agent": {
150-
"id": "ddaa4708-4109-4d2b-bbca-dc3fa4b8bfb5",
151-
"snapshot": false,
152-
"version": "8.16.0"
150+
"id": "a6b5dc9a-fdd8-48e8-93df-bd12211c464a",
151+
"snapshot": true,
152+
"version": "8.18.0"
153153
},
154154
"event": {
155155
"agent_id_status": "verified",
156156
"category": [
157-
"host"
157+
"vulnerability"
158158
],
159159
"dataset": "qualys_vmdr.asset_host_detection",
160160
"id": "11111111",
161-
"ingested": "2025-02-04T13:41:17Z",
161+
"ingested": "2025-04-08T09:44:12Z",
162162
"kind": "alert",
163163
"original": "{\"DETECTION_LIST\":{\"AFFECT_RUNNING_KERNEL\":\"0\",\"FIRST_FOUND_DATETIME\":\"2021-02-05T04:50:45Z\",\"IS_DISABLED\":\"0\",\"IS_IGNORED\":\"0\",\"LAST_FIXED_DATETIME\":\"2022-12-14T06:52:57Z\",\"LAST_FOUND_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_PROCESSED_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_TEST_DATETIME\":\"2024-03-08T20:15:41Z\",\"LAST_UPDATE_DATETIME\":\"2024-03-08T20:15:41Z\",\"QDS\":{\"#text\":\"35\",\"severity\":\"LOW\"},\"QDS_FACTORS\":{\"QDS_FACTOR\":[{\"#text\":\"7.7\",\"name\":\"CVSS\"},{\"#text\":\"v3.x\",\"name\":\"CVSS_version\"},{\"#text\":\"0.00232\",\"name\":\"epss\"},{\"#text\":\"AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H\",\"name\":\"CVSS_vector\"}]},\"QID\":\"101\",\"RESULTS\":\"Package\\tInstalled Version\\tRequired Version\\nlinux-cloud-tools-4.4.0\\t1074-aws_4.4.0-1074.84\\t1092\\nlinux-aws-tools-4.4.0\\t1074_4.4.0-1074.84\\t1092\\nlinux-aws-headers-4.4.0\\t1074_4.15.0-1126.135\\t1092\\nlinux-tools-4.4.0\\t1074-aws_4.4.0-1074.84\\t1092\\nlinux-aws-cloud-tools-4.4.0\\t1074_4.4.0-1074.84\\t1092\",\"SEVERITY\":\"3\",\"SSL\":\"0\",\"STATUS\":\"Active\",\"TIMES_FOUND\":\"5393\",\"TYPE\":\"Confirmed\",\"UNIQUE_VULN_ID\":\"11111111\"},\"DNS\":\"adfssrvr.adfs.local\",\"DNS_DATA\":{\"DOMAIN\":\"adfs.local\",\"FQDN\":\"adfssrvr.adfs.local\",\"HOSTNAME\":\"adfssrvr\"},\"ID\":\"1\",\"IP\":\"10.50.2.111\",\"KNOWLEDGE_BASE\":{\"CATEGORY\":\"CGI\",\"CONSEQUENCE\":\"Depending on the vulnerability being exploited, an unauthenticated remote attacker could conduct cross-site scripting, clickjacking or MIME-type sniffing attacks.\",\"CVE_LIST\":[\"CVE-2022-31629\",\"CVE-2022-31628\"],\"DIAGNOSIS\":\"This QID reports the absence of the following\",\"DISCOVERY\":{\"REMOTE\":\"1\"},\"LAST_SERVICE_MODIFICATION_DATETIME\":\"2023-06-29T12:20:46Z\",\"PATCHABLE\":\"0\",\"PCI_FLAG\":\"1\",\"PUBLISHED_DATETIME\":\"2017-06-05T21:34:49Z\",\"QID\":\"101\",\"SEVERITY_LEVEL\":\"2\",\"SOFTWARE_LIST\":{\"SOFTWARE\":[{\"PRODUCT\":\"None\",\"VENDOR\":\"multi-vendor\"}]},\"SOLUTION\":\"\\u003cB\\u003eNote:\\u003c/B\\u003e To better debug the results of this QID\",\"THREAT_INTELLIGENCE\":{\"THREAT_INTEL\":[{\"id\":\"8\"}]},\"TITLE\":\"HTTP Security Header Not Detected\",\"VULN_TYPE\":\"Vulnerability\"},\"LAST_PC_SCANNED_DATE\":\"2023-06-28T09:58:12Z\",\"LAST_SCAN_DATETIME\":\"2023-07-03T06:25:17Z\",\"LAST_VM_SCANNED_DATE\":\"2023-07-03T06:23:47Z\",\"LAST_VM_SCANNED_DURATION\":\"1113\",\"NETBIOS\":\"ADFSSRVR\",\"OS\":\"Windows 2016/2019/10\",\"TRACKING_METHOD\":\"IP\"}",
164164
"type": [
@@ -266,29 +266,33 @@ An example event for `asset_host_detection` looks as following:
266266
"last_vm_scanned_duration": 1113,
267267
"netbios": "ADFSSRVR",
268268
"os": "Windows 2016/2019/10",
269-
"package_nested": {
270-
"fixed_version": [
271-
"1092",
272-
"1092",
273-
"1092",
274-
"1092",
275-
"1092"
276-
],
277-
"name": [
278-
"linux-cloud-tools-4.4.0",
279-
"linux-aws-tools-4.4.0",
280-
"linux-aws-headers-4.4.0",
281-
"linux-tools-4.4.0",
282-
"linux-aws-cloud-tools-4.4.0"
283-
],
284-
"version": [
285-
"1074-aws_4.4.0-1074.84",
286-
"1074_4.4.0-1074.84",
287-
"1074_4.15.0-1126.135",
288-
"1074-aws_4.4.0-1074.84",
289-
"1074_4.4.0-1074.84"
290-
]
291-
},
269+
"package_nested": [
270+
{
271+
"fixed_version": "1092",
272+
"name": "linux-cloud-tools-4.4.0",
273+
"version": "1074-aws_4.4.0-1074.84"
274+
},
275+
{
276+
"fixed_version": "1092",
277+
"name": "linux-aws-tools-4.4.0",
278+
"version": "1074_4.4.0-1074.84"
279+
},
280+
{
281+
"fixed_version": "1092",
282+
"name": "linux-aws-headers-4.4.0",
283+
"version": "1074_4.15.0-1126.135"
284+
},
285+
{
286+
"fixed_version": "1092",
287+
"name": "linux-tools-4.4.0",
288+
"version": "1074-aws_4.4.0-1074.84"
289+
},
290+
{
291+
"fixed_version": "1092",
292+
"name": "linux-aws-cloud-tools-4.4.0",
293+
"version": "1074_4.4.0-1074.84"
294+
}
295+
],
292296
"tracking_method": "IP",
293297
"vulnerability": {
294298
"affect_running_kernel": "0",

‎packages/qualys_vmdr/elasticsearch/transform/latest_cdr_vulnerabilities/fields/base-fields.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
- name: data_stream.type
2+
external: ecs
3+
- name: data_stream.dataset
4+
external: ecs
5+
- name: data_stream.namespace
6+
external: ecs
7+
type: keyword
8+
- name: event.module
9+
external: ecs
10+
type: constant_keyword
11+
value: qualys_vmdr
12+
- name: event.dataset
13+
external: ecs
14+
type: constant_keyword
15+
value: qualys_vmdr.asset_host_detection
16+
- name: '@timestamp'
17+
external: ecs

‎packages/qualys_vmdr/elasticsearch/transform/latest_cdr_vulnerabilities/fields/beats.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- name: input.type
2+
type: keyword
3+
description: Type of filebeat input.
4+
- name: log.offset
5+
type: long
6+
description: Log offset.

‎packages/qualys_vmdr/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Define ECS constant fields as constant_keyword
2+
- name: observer.vendor
3+
type: constant_keyword
4+
external: ecs
5+
- name: vulnerability.scanner.vendor
6+
type: constant_keyword
7+
external: ecs
8+
# Other ECS fields
9+
- name: agent.ephemeral_id
10+
external: ecs
11+
- name: agent.id
12+
external: ecs
13+
- name: agent.name
14+
external: ecs
15+
- name: agent.type
16+
external: ecs
17+
- name: agent.version
18+
external: ecs
19+
- name: cloud.account.id
20+
external: ecs
21+
- name: cloud.account.name
22+
external: ecs
23+
- name: cloud.availability_zone
24+
external: ecs
25+
- name: cloud.instance.id
26+
external: ecs
27+
- name: cloud.instance.name
28+
external: ecs
29+
- name: cloud.machine.type
30+
external: ecs
31+
- name: cloud.project.id
32+
external: ecs
33+
- name: cloud.project.name
34+
external: ecs
35+
- name: cloud.provider
36+
external: ecs
37+
- name: cloud.region
38+
external: ecs
39+
- name: cloud.service.name
40+
external: ecs
41+
- name: ecs.version
42+
external: ecs
43+
- name: event.agent_id_status
44+
external: ecs
45+
- name: event.category
46+
external: ecs
47+
- name: event.id
48+
external: ecs
49+
- name: event.ingested
50+
external: ecs
51+
- name: event.kind
52+
external: ecs
53+
- name: event.type
54+
external: ecs
55+
- name: host.domain
56+
external: ecs
57+
- name: host.hostname
58+
external: ecs
59+
- name: host.id
60+
external: ecs
61+
- name: host.ip
62+
external: ecs
63+
- name: host.name
64+
external: ecs
65+
- name: host.os.full
66+
external: ecs
67+
- name: host.os.platform
68+
external: ecs
69+
- name: host.os.type
70+
external: ecs
71+
- name: package.name
72+
external: ecs
73+
- name: package.version
74+
external: ecs
75+
- name: related.hosts
76+
external: ecs
77+
- name: related.ip
78+
external: ecs
79+
- name: tags
80+
external: ecs
81+
- name: vulnerability.category
82+
external: ecs
83+
- name: vulnerability.classification
84+
external: ecs
85+
- name: vulnerability.description
86+
external: ecs
87+
- name: vulnerability.enumeration
88+
external: ecs
89+
- name: vulnerability.id
90+
external: ecs
91+
- name: vulnerability.reference
92+
external: ecs
93+
- name: vulnerability.score.base
94+
external: ecs
95+
- name: vulnerability.score.version
96+
external: ecs
97+
- name: vulnerability.severity
98+
external: ecs

0 commit comments

Comments
 (0)