generate-new-vulnerability-scan-reports.json

{
  "schema_version": 4,
  "name": "Generate new vulnerability scan reports",
  "description": "Submit requests for new scan reports via a simple Tines form. The form then generates a new report in Qualys, and this Story sends the results in an attachment via email to the submitter.\n\ntags: Report, Qualys, Beginner, Orchestrate\nicons: 📝, 👀, 📧\nvisibility: public\n",
  "guid": "7021806295686a86bdd0d941efb77cb6",
  "slug": "generate_new_vulnerability_scan_reports",
  "exported_at": "2022-07-11T17:32:57Z",
  "agents": [
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Delay for 2 minutes",
      "disabled": false,
      "guid": "238b9bd3a779c636dd9c2ec57c04f5a4",
      "options": {
        "mode": "delay",
        "seconds": "120"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Trigger if Running",
      "disabled": false,
      "guid": "ddc680611ecc906918fcbcbf249c6864",
      "options": {
        "rules": [
          {
            "type": "field!=value",
            "path": "<<query_qualys_report.body.REPORT_LIST_OUTPUT.RESPONSE.REPORT_LIST.REPORT.STATUS.STATE>>",
            "value": "Finished"
          },
          {
            "type": "field==value",
            "path": "<<query_qualys_report.status>>",
            "value": "200"
          }
        ],
        "must_match": "2"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      }
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Download Saved Report",
      "disabled": false,
      "guid": "f04f3011c9c939afbf58fa3d98780dcf",
      "options": {
        "url": "https://<<RESOURCE.qualys_domain>>/api/2.0/fo/report/",
        "method": "post",
        "payload": {
          "id": "<<run_report_in_qualys.body.SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE>>",
          "action": "fetch"
        },
        "headers": {
          "Authorization": "Basic <<CREDENTIAL.qualys>>",
          "Host": "<<RESOURCE.qualys_domain>>",
          "X-Requested-With": "Tines",
          "Accept-Encoding": "gzip, deflate",
          "Content-Length": "0",
          "cache-control": "no-cache",
          "User-Agent": "Tines",
          "Accept": "*/*"
        },
        "log_error_on_status": []
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Trigger if Finished",
      "disabled": false,
      "guid": "c52c9b5dd1539035eb9d916d25ee9fae",
      "options": {
        "rules": [
          {
            "type": "field==value",
            "path": "<<query_qualys_report.body.REPORT_LIST_OUTPUT.RESPONSE.REPORT_LIST.REPORT.STATUS.STATE>>",
            "value": "Finished"
          }
        ]
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      }
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Run Report in Qualys",
      "disabled": false,
      "guid": "b257e33a540d98e9d056a820aeb736fb",
      "options": {
        "url": "https://<<RESOURCE.qualys_domain>>/api/2.0/fo/report/",
        "method": "post",
        "payload": {
          "action": "launch",
          "template_id": "<<DEFAULT(receive_form.body.template_id, \"1515808\")>>",
          "output_format": "csv",
          "report_title": "Vulnerability Report for <<receive_form.body.ip>>",
          "report_type": "Scan",
          "ips": "<<receive_form.body.ip>>"
        },
        "headers": {
          "Authorization": "Basic <<CREDENTIAL.qualys>>",
          "Host": "<<RESOURCE.qualys_domain>>",
          "X-Requested-With": "Tines",
          "User-Agent": "Tines"
        },
        "log_error_on_status": []
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Query Qualys Report",
      "disabled": false,
      "guid": "ec159ffff1a1b0076fe5c2fed0dd82b9",
      "options": {
        "url": "https://<<RESOURCE.qualys_domain>>/api/2.0/fo/report/",
        "method": "post",
        "payload": {
          "action": "list",
          "id": "<<run_report_in_qualys.body.SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE>>"
        },
        "headers": {
          "Authorization": "Basic <<CREDENTIAL.qualys>>",
          "Host": "<<RESOURCE.qualys_domain>>",
          "X-Requested-With": "Tines",
          "User-Agent": "Tines"
        },
        "log_error_on_status": []
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::WebhookAgent",
      "name": "Receive Form",
      "disabled": false,
      "guid": "a51760ece96a970f94390b346c565fe7",
      "options": {
        "secret": "88d632efeed2c71e593d5a6f72dd8c71",
        "verbs": "get,post",
        "path": "0921a7486acef4edc788b427eb25669b"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      }
    },
    {
      "type": "Agents::EventTransformationAgent",
      "name": "Increment Counter",
      "disabled": false,
      "guid": "987a303ac8826607603b12a91308de72",
      "options": {
        "mode": "message_only",
        "payload": {
          "counter": "<<PLUS(increment_counter.counter, 1)>>"
        }
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Counter Less Than 15",
      "disabled": false,
      "guid": "c0d82b772c4c91fafe6e51f793cea453",
      "options": {
        "rules": [
          {
            "type": "field<value",
            "value": "15",
            "path": "<<increment_counter.counter>>"
          }
        ]
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      }
    },
    {
      "type": "Agents::TriggerAgent",
      "name": "Counter More Than 15",
      "disabled": false,
      "guid": "26205f103241bd87dfde796758d1d28f",
      "options": {
        "rules": [
          {
            "type": "field>=value",
            "value": "15",
            "path": "<<increment_counter.counter>>"
          }
        ]
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      }
    },
    {
      "type": "Agents::EmailAgent",
      "name": "Email Report Failed",
      "disabled": false,
      "guid": "11052e630626ab884ab5926bd6e3ab97",
      "options": {
        "recipients": "<<receive_form.body.email>>",
        "subject": "FAILED: Vulnerability Report for <<receive_form.body.ip>>",
        "body": "The vulnerability report from Qualys you requested failed to run.<br><br> Please reach out to Security Engineering team to troubleshoot. <br><br> Thanks, <br> Security Automation"
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::EmailAgent",
      "name": "Email Report",
      "disabled": false,
      "guid": "fdf2d55a6069ccb1f729483e43f3694b",
      "options": {
        "recipients": "<<receive_form.body.email>>",
        "subject": "Vulnerability Report for <<receive_form.body.ip>>",
        "body": "Please find the vulnerability report from Qualys you requested. <br><br> Reach out to Security Engineering in case of any questions regarding this report. <br><br> Thanks, <br> Security Automation",
        "attachments": {
          "filename": "<<receive_form.body.ip>>_scan_report.csv",
          "base64encodedcontents": "<<BASE64_ENCODE(download_saved_report.body)>>"
        }
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    },
    {
      "type": "Agents::HTTPRequestAgent",
      "name": "Attach report email in o365",
      "disabled": true,
      "guid": "982842cf323daf9ea1db78b13a816c52",
      "options": {
        "url": "https://graph.microsoft.com/v1.0/users/<<email_address>>/sendMail",
        "content_type": "json",
        "method": "post",
        "payload": {
          "message": {
            "subject": "Tines test- Qualys Vulnerability Report",
            "body": {
              "contentType": "HTML",
              "content": "Hi,<br><br> Please find the vulnerability report from Qualys you requested. Please work on remediating the vulnerabilities.<br> Reach out to Security Engineering in case of any queries. <br><br> Thanks, <br> Security Automation"
            },
            "toRecipients": [
              {
                "emailAddress": {
                  "address": "<<receive_form.body.email>>"
                }
              }
            ],
            "attachments": [
              {
                "@odata.type": "microsoft.graph.fileAttachment",
                "name": "scan_report.csv",
                "contentBytes": "<<BASE64_ENCODE(download_saved_report.body)>>"
              }
            ]
          },
          "saveToSentItems": "true"
        },
        "headers": {
          "Authorization": "Bearer <<CREDENTIAL.msgraph>>"
        }
      },
      "reporting": {
        "time_saved_value": 0,
        "time_saved_unit": "minutes"
      },
      "monitoring": {
        "monitor_all_events": false,
        "monitor_failures": false,
        "monitor_no_events_emitted": null
      },
      "schedule": null
    }
  ],
  "diagram_notes": [
    {
      "content": "# Loops in Tines\n\nServices like Qualys operate by scheduling jobs to be run and then returning results when the job is finished.\n\nWhen Tines queries to see if a report is complete or not, if the job is still running Tines will enter into a loop. In this particular example, there is a counter that will be incremented up by 1 up to a maximum of 15. After the counter is incremented, Tines will delay the event by two minutes. This effectively creates a window of 30 minutes for the report to complete. If the report does not finish in that time, an email will be sent alerting the requesting individual that the report did not complete successfully.",
      "position": [
        120.0,
        690.0
      ],
      "guid": "229fb591ac10c7eba13b2080d2945679",
      "width": null
    },
    {
      "content": "# Email The Report!\n\nOnce the report completes, it will be sent as an attachment in an email to the address submitted in the form.",
      "position": [
        435.0,
        600.0
      ],
      "guid": "1f8cef01838eb972ea80c42fe49ebd78",
      "width": null
    },
    {
      "content": "# Configure Qualys Connection\n\nCreate a Credential in Tines named `Qualys` with the type Text which will contain your Qualys API key.\n\nCreate a Resource in Tines named `Qualys Domain` which will contain the server URL where your Qualys account is located.\n\n👈 Fill out the default report template ID in the action `Run Report in Qualys`.\n\nMore information regarding the Qualys API can be found [here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf).",
      "position": [
        480.0,
        45.0
      ],
      "guid": "c7c27a1dbde4237c2746c55c6d521eca",
      "width": null
    },
    {
      "content": "https://image-uploads.tines.com/qualys.png \n\nHow quickly vulnerability reports are run can be the difference between launching a new service on time or not. Many infrastructure and development teams need self service access to run reports against their applications to not only know what vulnerabilities exist in the first place, but also if remediation efforts truly addressed vulnerabilities seen. Tines helps enable these other teams to achieve fast business outcomes by opening up small workflows that involve platforms with sensitive access requirements.\n\nThis story allows users to submit new scan report requests via the \"Form\" feature in Tines. The form will trigger a new report being generated in Qualys. Report results will be sent as an attachment to the email submitted in the form.\n\n[Link to Form](./form)",
      "position": [
        -105.0,
        0.0
      ],
      "guid": "21c5c2095ebade339bec09af47a3bdfc",
      "width": null
    }
  ],
  "links": [
    {
      "source": 0,
      "receiver": 5
    },
    {
      "source": 1,
      "receiver": 7
    },
    {
      "source": 2,
      "receiver": 12
    },
    {
      "source": 2,
      "receiver": 11
    },
    {
      "source": 3,
      "receiver": 2
    },
    {
      "source": 4,
      "receiver": 5
    },
    {
      "source": 5,
      "receiver": 1
    },
    {
      "source": 5,
      "receiver": 3
    },
    {
      "source": 6,
      "receiver": 4
    },
    {
      "source": 7,
      "receiver": 8
    },
    {
      "source": 7,
      "receiver": 9
    },
    {
      "source": 8,
      "receiver": 0
    },
    {
      "source": 9,
      "receiver": 10
    }
  ],
  "diagram_layout": "{\"238b9bd3a779c636dd9c2ec57c04f5a4\":[210,600],\"ddc680611ecc906918fcbcbf249c6864\":[210,375],\"f04f3011c9c939afbf58fa3d98780dcf\":[435,450],\"c52c9b5dd1539035eb9d916d25ee9fae\":[435,375],\"b257e33a540d98e9d056a820aeb736fb\":[210,225],\"ec159ffff1a1b0076fe5c2fed0dd82b9\":[210,300],\"a51760ece96a970f94390b346c565fe7\":[210,150],\"987a303ac8826607603b12a91308de72\":[210,450],\"c0d82b772c4c91fafe6e51f793cea453\":[210,525],\"26205f103241bd87dfde796758d1d28f\":[-15,525],\"11052e630626ab884ab5926bd6e3ab97\":[-15,600],\"fdf2d55a6069ccb1f729483e43f3694b\":[435,525],\"982842cf323daf9ea1db78b13a816c52\":[630,525]}",
  "send_to_story_enabled": false,
  "entry_agent_guid": null,
  "exit_agent_guids": [],
  "exit_agent_guid": null,
  "send_to_stories": [],
  "form": {
    "name": "Run a Vulnerability Management Scan",
    "description": "",
    "fields": [
      {
        "name": "Email",
        "description": "Email address which the final report will be sent to.",
        "required": true,
        "type": "SHORT_TEXT",
        "multi_select": false,
        "options": [
          "Option 1",
          "Option 2"
        ],
        "ranking": 1073741824,
        "max_characters": null,
        "tenant_id": 8687
      },
      {
        "name": "IP",
        "description": "IP address to scan.",
        "required": true,
        "type": "SHORT_TEXT",
        "multi_select": false,
        "options": [
          "Option 1",
          "Option 2"
        ],
        "ranking": 0,
        "max_characters": null,
        "tenant_id": 8687
      },
      {
        "name": "Template ID",
        "description": "The ID number of the report template you want to run. (Optional)",
        "required": false,
        "type": "SHORT_TEXT",
        "multi_select": false,
        "options": [
          "Option 1",
          "Option 2"
        ],
        "ranking": 1610612736,
        "max_characters": null,
        "tenant_id": 8687
      }
    ],
    "visibility": "tenant",
    "agent_guid": "a51760ece96a970f94390b346c565fe7",
    "success_message": "Thank you for your submission"
  }
}