Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Qualys

USE CASE 2: ASSET MANAGEMENT - INFOBLOX & QUALYS INTEGRATION

[ Edited ]

Adviser

Posts: 172

Registered: ‎09-09-2015

‎10-26-2016 03:52 PM - edited ‎11-03-2016 08:43 AM

Posts: 82

Hi There,

The template attached to the post is used in the second use case (Asset management) on the video.

Outbound API feature is very powerful and this template is most complicated among the templates used on the video.

Extensible attributes (Qualys_Asset_VM, Qualys_Asset_PC, Qualys_Scan_On_Add, Qualys_Assets_Group, Qualys_Scan_Option, Qualys_Scanner ,Qualys_User_SNMP, Qualys_User_Unix) are required and should be defined on a network or range level (depends on an event type).

Based on the extensible attributes values the template performs different actions:

Qualys_Asset_VM - add an asset to Vulnerability Management;
Qualys_Asset_PC - add an asset to Policy Compliance;
Qualys_Assets_Group - add an asset to an asset group defined in this EA;
Qualys_User_SNMP - associate an asset with the SNMP community defined in this EA;
Qualys_User_Unix - associate an asset with the Unix's CLI credentials defined in this EA;
Qualys_Scan_Option - use a scan option defined in this EA for scans;
Qualys_Scanner - use a scanner appliance defined in this EA;
Qualys_Scan_On_Add - perform a scan immediately after adding the appliance to the assets.

You can use attached php script to create these EAs (do not forget to update $NIOS_baseURL, $NIOS_User, $NIOS_PWD, $data variables based on your configuration).

BR,
Vadim