New Integration - Qualys Web application Scanning Integration (qualys_was) #14139

StacieClark-Elastic · 2025-06-03T20:49:41Z

Proposed commit message

New Integration for Qualys Web Application Scanning

This application makes API calls to a Qualys Web Application scanning service for vulnerability detections then augments the detections with data from API calls to the Qualys Knowledge base for information about the vulnerability detected.

elasticmachine · 2025-06-03T20:49:44Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-06-04T04:37:17Z

Do the test expectations need to be updated or is there a breakage?

packages/qualys_was/_dev/deploy/docker/docker-compose.yml

packages/qualys_was/_dev/deploy/docker/files/config.yml

packages/qualys_was/data_stream/vulnerability/_dev/test/pipeline/test-common-config.yml

packages/qualys_was/data_stream/vulnerability/_dev/test/pipeline/test-non-verbose-findings.log

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

packages/qualys_was/_dev/build/docs/README.md

packages/qualys_was/kibana/dashboard/qualys_was-e98bb088-8853-4e6a-8887-c3f301100fe6.json

packages/qualys_was/data_stream/vulnerability/fields/kb_fields.yml

...lys_was/data_stream/vulnerability/_dev/test/pipeline/test-verbose-findings.log-expected.json

elastic-vault-github-plugin-prod · 2025-06-05T20:50:40Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

packages/qualys_was/_dev/build/docs/README.md

packages/qualys_was/_dev/deploy/docker/files/config.yml

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

packages/qualys_was/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-06-10T06:17:41Z

packages/qualys_was/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

+ if: ctx.Finding != null && ctx.Finding.knowledge_base != null && ctx.Finding.knowledge_base.size() > 0
+ tag: pipeline_knowledge_base
+ ignore_missing_pipeline: true
+on_failure:


Suggested change

on_failure:

- set:

field: event.kind

value: pipeline_error

tag: set_pipeline_error_into_event_kind

if: ctx.error?.message != null

- append:

field: tags

value: preserve_original_event

allow_duplicates: false

if: ctx.error?.message != null

on_failure:

There are processors above that can error without failing, so we need to condition the document for retaining the event.original in those cases.

I'm not sure why I resolve this. There are still cases where this has merit. Maybe remove the set event.kind, but the preserve_original_event into tags is needed.

I read the comment wrong. I originally put the change after on_failure.
The way I've written the ingest, I don't want it to fail if error.message has been written into by a on_failure nodes in the processor. I added in the append for the tag.

packages/qualys_was/img/qualys-was-integrations-page.png

packages/qualys_was/manifest.yml

efd6 · 2025-06-18T21:19:33Z

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

+ (has(state.vulnerability_filter) ? state
+ :
+ state.with(


The conventional form for multiline ternaries is

condition_expression ? true_branch_expression : false_branch_expression

In cases where there is a zero avaluation (e.g. {} here) this has been historically

condition_expression ? {} : false_branch_expression

but this is not recognised by celfmt, so these will go away when that is more widely rolled out, and I am not convinced that state is a zero.

Note that the branches are indented relative to the ternary syntax and the : is aligned with the condition expression. Exact indentation is not yet formalised, but will most likely resolve to two spaces to match the YAML convention used here.

packages/qualys_was/_dev/build/docs/README.md

packages/qualys_was/_dev/deploy/docker/files/config.yml

packages/qualys_was/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

packages/qualys_was/data_stream/vulnerability/_dev/test/pipeline/test-common-config.yml

efd6 · 2025-06-18T21:48:44Z

packages/qualys_was/_dev/deploy/docker/files/config.yml

I'll take another look at the program after the indentation is fixed up.

efd6

Minor changes only.

efd6 · 2025-06-23T23:14:34Z

packages/qualys_was/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml

+ if: ctx.Finding != null && ctx.Finding.knowledge_base != null && ctx.Finding.knowledge_base.size() > 0
+ tag: pipeline_knowledge_base
+ ignore_missing_pipeline: true
+on_failure:


I'm not sure why I resolve this. There are still cases where this has merit. Maybe remove the set event.kind, but the preserve_original_event into tags is needed.

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

efd6 · 2025-06-23T23:20:13Z

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

+ "Body": state.Body.encode_json(),
+ }
+ ).do_request().as(resp, (resp.StatusCode == 200) ?
+ try(bytes(resp.Body).decode_json(), "decode_error").as(body,


Suggested change

try(bytes(resp.Body).decode_json(), "decode_error").as(body,

try(resp.Body.decode_json(), "decode_error").as(body,

packages/qualys_was/_dev/build/docs/README.md

efd6 · 2025-06-24T20:51:54Z

packages/qualys_was/data_stream/vulnerability/agent/stream/cel.yml.hbs

+ (size(resp.Body) != 0) ?
+ string(resp.Body)
+ :
+ " no body "


Suggested change

" no body "

"no body"

initial draft for qualys_was. An agentless integration for ingesting web application scanning data

Added system tests. Added another pipeline test

Updated changelog.yml with correct PR number

added package to CODEOWNERS file

Rolled back accidental change to qualys_vmdr integration README

Added back line in default.yml that had been accidentally deleted

Added images of dashboards. Cleanup work to make files adhere to style standards

Cleaned up README

Inverted the branches in 2 places

Restructured cel.yml.hbs file to be easier to read and understand

Suggested changes from review for documentation.

Added comments to CEL script

Changed result_list to type text and do not index it

Removed out of date integrations page screenshot.

Adds original event tag if there is an error

Restored file that should not have been changed

Reformatted the cel script. Fixed an error in the readme. Fixed the regex for the system test config

Minor changes.

Added some more documentation about scan history purging

Included information about scan history being returned in ther 3.20 API and before

Updated generated README

…in CEL script

elastic-sonarqube · 2025-06-24T23:10:10Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
90.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2025-06-24T23:10:16Z

💚 Build Succeeded

Buildkite Build
Commit: 52114e7

History

💚 Build #27607 succeeded eb233fc
💔 Build #27606 failed 4927ff6
💚 Build #27570 succeeded e17b290
💚 Build #27427 succeeded efecdff
💚 Build #27423 succeeded 2a8085d
💚 Build #27341 succeeded 04afcbc

efd6

Thanks

elastic-vault-github-plugin-prod · 2025-06-25T03:42:34Z

Package qualys_was - 0.1.0 containing this change is available at https://epr.elastic.co/package/qualys_was/0.1.0/

…_was) (elastic#14139) New Integration for Qualys Web Application Scanning This application makes API calls to a Qualys Web Application scanning service for vulnerability detections then augments the detections with data from API calls to the Qualys Knowledge base for information about the vulnerability detected.

StacieClark-Elastic requested a review from a team as a code owner June 3, 2025 20:49

StacieClark-Elastic added the New Integration Issue or pull request for creating a new integration package. label Jun 3, 2025

StacieClark-Elastic requested a review from a team as a code owner June 3, 2025 20:49

StacieClark-Elastic added Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:qualys_was Qualys Web Application Scanning (WAS) labels Jun 3, 2025

efd6 reviewed Jun 4, 2025

View reviewed changes

packages/qualys_was/data_stream/vulnerability/fields/kb_fields.yml Outdated Show resolved Hide resolved

...lys_was/data_stream/vulnerability/_dev/test/pipeline/test-verbose-findings.log-expected.json Show resolved Hide resolved

andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Jun 4, 2025

StacieClark-Elastic marked this pull request as draft June 4, 2025 22:49

StacieClark-Elastic marked this pull request as ready for review June 5, 2025 20:53

StacieClark-Elastic requested a review from efd6 June 5, 2025 20:56

efd6 reviewed Jun 10, 2025

View reviewed changes

StacieClark-Elastic force-pushed the feature/qualys-was-13569 branch 2 times, most recently from 6454049 to fbe8418 Compare June 16, 2025 12:03

StacieClark-Elastic requested a review from efd6 June 17, 2025 19:00

StacieClark-Elastic force-pushed the feature/qualys-was-13569 branch 2 times, most recently from 2a8085d to efecdff Compare June 18, 2025 18:55

StacieClark-Elastic enabled auto-merge (squash) June 18, 2025 20:58

efd6 reviewed Jun 18, 2025

View reviewed changes

StacieClark-Elastic force-pushed the feature/qualys-was-13569 branch from efecdff to e17b290 Compare June 23, 2025 22:26

StacieClark-Elastic requested a review from efd6 June 23, 2025 23:07

efd6 reviewed Jun 23, 2025

View reviewed changes

StacieClark-Elastic force-pushed the feature/qualys-was-13569 branch from e17b290 to 4276255 Compare June 24, 2025 15:39

StacieClark-Elastic requested a review from efd6 June 24, 2025 15:42

efd6 reviewed Jun 24, 2025

View reviewed changes

StacieClark-Elastic added 2 commits June 24, 2025 18:47

feature/qualys-was-12008

142ef4f

initial draft for qualys_was. An agentless integration for ingesting web application scanning data

feature/qualys-was-12008

aa4fdec

Added system tests. Added another pipeline test

StacieClark-Elastic added 20 commits June 24, 2025 18:47

feature/qualys-was-13569

d388bdf

Updated changelog.yml with correct PR number

feature/qualys-was-13569

f3f285a

added package to CODEOWNERS file

feature/qualys-was-13569

2fc0fec

Rolled back accidental change to qualys_vmdr integration README

feature/qualys-was-13569

f0cf29c

Added back line in default.yml that had been accidentally deleted

feature/qualys-was-13569

26a0479

Added images of dashboards. Cleanup work to make files adhere to style standards

feature/qualys-was-13569

e023ed3

Cleaned up README

feature/qualys-was-13569

d8fc40a

Inverted the branches in 2 places

feature/qualys-was-13569

43319e1

Restructured cel.yml.hbs file to be easier to read and understand

feature/qualys-was-13569

d272720

Suggested changes from review for documentation.

feature/qualys-was-13569

5a4a21a

Added comments to CEL script

feature/qualys-was-13569

ce08f4e

Changed result_list to type text and do not index it

feature/qualys-was-13569

5712f90

Removed out of date integrations page screenshot.

feature/qualys-was-13569

a9fcbaf

Adds original event tag if there is an error

feature/qualys-was-13569

82bc216

Restored file that should not have been changed

feature/qualys-was-13569

83e69f8

Reformatted the cel script. Fixed an error in the readme. Fixed the regex for the system test config

feature/qualys-was-13569

105b5b6

Minor changes.

feature/qualys-was-13569

b184ab7

Added some more documentation about scan history purging

feature/qualys-was-13569

e53ab46

Included information about scan history being returned in ther 3.20 API and before

feature/qualys-was-13569

3f62733

Updated generated README

feature/qualys-was-13569 Review driven README changes and one change …

52114e7

…in CEL script

StacieClark-Elastic force-pushed the feature/qualys-was-13569 branch from 6f5c26c to 52114e7 Compare June 24, 2025 22:47

StacieClark-Elastic requested a review from efd6 June 24, 2025 23:29

efd6 approved these changes Jun 25, 2025

View reviewed changes

kcreddy approved these changes Jun 25, 2025

View reviewed changes

StacieClark-Elastic merged commit dacae63 into elastic:main Jun 25, 2025
7 checks passed

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 1, 2025

-on_failure:
+ - set:
+ field: event.kind
+ value: pipeline_error
+ tag: set_pipeline_error_into_event_kind
+ if: ctx.error?.message != null
+ - append:
+ field: tags
+ value: preserve_original_event
+ allow_duplicates: false
+ if: ctx.error?.message != null
+on_failure:

	try(bytes(resp.Body).decode_json(), "decode_error").as(body,
	try(resp.Body.decode_json(), "decode_error").as(body,

New Integration - Qualys Web application Scanning Integration (qualys_was) #14139

New Integration - Qualys Web application Scanning Integration (qualys_was) #14139

Uh oh!

Conversation

StacieClark-Elastic commented Jun 3, 2025

Proposed commit message

elasticmachine commented Jun 3, 2025

efd6 commented Jun 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Jun 5, 2025

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

efd6 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

elastic-sonarqube bot commented Jun 24, 2025

Quality Gate passed

elasticmachine commented Jun 24, 2025

💚 Build Succeeded

History

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod bot commented Jun 25, 2025

Labels

5 participants