Qualys Fetch Vulnerabilities - Include all vulnerabilities on assets

[johnnywilkes]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• [] In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

https://jira-dc.paloaltonetworks.com/browse/EXPANDR-10862

Description

Proposed change is making sure we not only pull Qualys vulnerabilities modified in the last 90 days but also those that are affecting assets that haven’t been modified in the last 90 days. This is to make sure this isn’t a breaking change.
How we do this:

1. Every time assets are pulled create a list of vulnerabilities (QIDs) we see on them.
2. Deduplicate this list.
3. Add the list to getAssetsLastRun()
4. When we lookup vulnerabilities, first do the call to pull all vulnerabilities modified in last 90 days and create list of these QIDs
5. Compare list from steps 3 and 4 and deduplicate (create a list of QIDs found on assets that haven’t been modified for last 90 days)
6. 2nd API call to pull these vulnerabilities that hadn’t been pulled before
7. Send full list of vulnerabilties to XSIAM

Must have

• Tests
• Documentation

[johnnywilkes]

@ShirleyDenkberg , please review when possible

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @aaron1535 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @johnnywilkes, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

[content-bot]

Hello,
Thank you for your contribution.
Unfortunately, your PR review will be slightly delayed because of an Israeli holiday in the upcoming two weeks (16-26.10.24). Thank you in advance for the patience.

[ShirleyDenkberg]

@aaron1535 Doc review completed.

[aaron1535]

Hi @johnnywilkes
Thank you for your contribution.
Nice job!
Please correct my comment and we can merge

[johnnywilkes]

@aaron1535 , thank you. Merge when possible, please

[github-actions]

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

[johnnywilkes]

@aaron1535 the internal PR #36899 seems to be removed, what are next steps?