Skip to content

Commit b29dd4d

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #14381 from spurthicode/spurthi_sentinel
Adding a new query string parameter
2 parents eeed41f + 8fc9dc3 commit b29dd4d

8 files changed

Lines changed: 357 additions & 251 deletions

File tree

‎Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_ConnectorDefinition.json‎

Lines changed: 37 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
2-
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
3-
"apiVersion": "2025-03-01",
42
"name": "QualysVMLogsCCPDefinition",
3+
"apiVersion": "2025-03-01",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
55
"location": "{{location}}",
66
"kind": "Customizable",
77
"properties": {
@@ -36,8 +36,8 @@
3636
}
3737
],
3838
"availability": {
39-
"status": 1,
40-
"isPreview": false
39+
"isPreview": false,
40+
"status": 1
4141
},
4242
"permissions": {
4343
"resourceProvider": [
@@ -47,8 +47,8 @@
4747
"providerDisplayName": "Workspace",
4848
"scope": "Workspace",
4949
"requiredPermissions": {
50-
"read": true,
5150
"write": true,
51+
"read": true,
5252
"delete": true,
5353
"action": false
5454
}
@@ -57,7 +57,7 @@
5757
"customs": [
5858
{
5959
"name": "API access and roles",
60-
"description": "Ensure the Qualys VM user has a role of Reader or higher. If the role is Reader, ensure that API access is enabled for the account. Auditor role is not supported to access the API. For more details, refer to the Qualys VM [Host Detection API](https://docs.qualys.com/en/vm/qweb-all-api/mergedProjects/qapi-assets/host_lists/host_detection.htm#v_5_0) and [User role Comparison](https://qualysguard.qualys.com/qwebhelp/fo_portal/user_accounts/user_roles_comparison_vm.htm) document."
60+
"description": "Ensure the Qualys VM user has a role of Reader or higher. If the role is Reader, ensure that API access is enabled for the account. Auditor role is not supported to access the API. For more details, refer to the Qualys VM [Host Detection API](https://docs.qualys.com/en/vm/qweb-all-api/mergedProjects/qapi-assets/host_lists/host_detection.htm#v_5_0) and [User role Comparison](https://docs.qualys.com/en/vm/latest/user_accounts/user_roles_comparison_vm.htm) document."
6161
}
6262
]
6363
},
@@ -96,7 +96,9 @@
9696
"placeholder": "Enter UserName",
9797
"type": "text",
9898
"name": "username",
99-
"required": true
99+
"validations": {
100+
"required": true
101+
}
100102
}
101103
},
102104
{
@@ -106,7 +108,9 @@
106108
"placeholder": "Enter password",
107109
"type": "password",
108110
"name": "password",
109-
"required": true
111+
"validations": {
112+
"required": true
113+
}
110114
}
111115
},
112116
{
@@ -116,16 +120,18 @@
116120
"placeholder": "Enter API Server URL",
117121
"type": "text",
118122
"name": "apiServerUrl",
119-
"required": true,
120-
"description": "Ensure the API Server URL starts with https:// and paste the whole API Server URL without / at the ending"
123+
"description": "Ensure the API Server URL starts with https:// and paste the whole API Server URL without / at the ending",
124+
"validations": {
125+
"required": true
126+
}
121127
}
122128
},
123129
{
124130
"type": "Markdown",
125131
"parameters": {
126132
"content": "#### 3. Truncation Limit \n Configure the maximum number of host records to retrieve per API call (20-5000 range). Higher values may improve performance but could impact API response times."
127133
}
128-
},
134+
},
129135
{
130136
"type": "Dropdown",
131137
"parameters": {
@@ -162,6 +168,26 @@
162168
"required": true
163169
}
164170
},
171+
{
172+
"type": "Dropdown",
173+
"parameters": {
174+
"label": "Show QDS Value",
175+
"name": "show_qds",
176+
"options": [
177+
{
178+
"key": "0",
179+
"text": "False (default)"
180+
},
181+
{
182+
"key": "1",
183+
"text": "True"
184+
}
185+
],
186+
"placeholder": "Select QDS value",
187+
"isMultiSelect": false,
188+
"required": true
189+
}
190+
},
165191
{
166192
"type": "ConnectionToggleButton",
167193
"parameters": {

‎Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_DCR.json‎

Lines changed: 72 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,79 @@
1-
[
2-
{
3-
"name": "QualysVMDCR",
4-
"apiVersion": "2023-03-11",
5-
"type": "Microsoft.Insights/dataCollectionRules",
6-
"location": "{{location}}",
7-
"properties": {
8-
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
9-
"streamDeclarations": {
10-
"Custom-QualysVM": {
11-
"columns": [
12-
{
13-
"name": "ID",
14-
"type": "string"
15-
},
16-
{
17-
"name": "IP",
18-
"type": "string"
19-
},
20-
{
21-
"name": "TRACKING_METHOD",
22-
"type": "string"
23-
},
24-
{
25-
"name": "OS",
26-
"type": "dynamic"
27-
},
28-
{
29-
"name": "DNS",
30-
"type": "dynamic"
31-
},
32-
{
33-
"name": "NETBIOS",
34-
"type": "dynamic"
35-
},
36-
{
37-
"name": "QG_HOSTID",
38-
"type": "dynamic"
39-
},
40-
{
41-
"name": "LAST_SCAN_DATETIME",
42-
"type": "datetime"
43-
},
44-
{
45-
"name": "LAST_VM_SCANNED_DATE",
46-
"type": "datetime"
47-
},
48-
{
49-
"name": "LAST_VM_AUTH_SCANNED_DATE",
50-
"type": "datetime"
51-
},
52-
{
53-
"name": "DETECTION_LIST",
54-
"type": "dynamic"
55-
}
56-
]
57-
}
58-
},
59-
"destinations": {
60-
"logAnalytics": [
1+
{
2+
"name": "QualysVMDCR",
3+
"apiVersion": "2023-03-11",
4+
"type": "Microsoft.Insights/dataCollectionRules",
5+
"location": "{{location}}",
6+
"properties": {
7+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
8+
"streamDeclarations": {
9+
"Custom-QualysVM": {
10+
"columns": [
11+
{
12+
"name": "ID",
13+
"type": "string"
14+
},
15+
{
16+
"name": "IP",
17+
"type": "string"
18+
},
19+
{
20+
"name": "TRACKING_METHOD",
21+
"type": "string"
22+
},
23+
{
24+
"name": "OS",
25+
"type": "dynamic"
26+
},
27+
{
28+
"name": "DNS",
29+
"type": "dynamic"
30+
},
31+
{
32+
"name": "NETBIOS",
33+
"type": "dynamic"
34+
},
35+
{
36+
"name": "QG_HOSTID",
37+
"type": "dynamic"
38+
},
39+
{
40+
"name": "LAST_SCAN_DATETIME",
41+
"type": "datetime"
42+
},
43+
{
44+
"name": "LAST_VM_SCANNED_DATE",
45+
"type": "datetime"
46+
},
47+
{
48+
"name": "LAST_VM_AUTH_SCANNED_DATE",
49+
"type": "datetime"
50+
},
6151
{
62-
"workspaceResourceId": "{{workspaceResourceId}}",
63-
"name": "clv2ws1"
52+
"name": "DETECTION_LIST",
53+
"type": "dynamic"
6454
}
6555
]
66-
},
67-
"dataFlows": [
56+
}
57+
},
58+
"destinations": {
59+
"logAnalytics": [
6860
{
69-
"streams": [
70-
"Custom-QualysVM"
71-
],
72-
"destinations": [
73-
"clv2ws1"
74-
],
75-
"transformKql": "source | extend HostId = tostring(ID), IPAddress = tostring(IP), TrackingMethod = tostring(TRACKING_METHOD), OperatingSystem = tostring(OS['#cdata-section']), DnsName = tostring(DNS['#cdata-section']), NetBios = tostring(NETBIOS['#cdata-section']), QGHostId = tostring(QG_HOSTID['#cdata-section']), LastScanDateTime = todatetime(LAST_SCAN_DATETIME), LastVMScannedDateTime = todatetime(LAST_VM_SCANNED_DATE), LastVMAuthScannedDateTime = todatetime(LAST_VM_AUTH_SCANNED_DATE), DetectionList = DETECTION_LIST, TimeGenerated = now() | project HostId, IPAddress, TrackingMethod, OperatingSystem, DnsName, NetBios, QGHostId, LastScanDateTime, LastVMScannedDateTime, LastVMAuthScannedDateTime, DetectionList, TimeGenerated",
76-
"outputStream": "Custom-QualysHostDetectionV3_CL"
61+
"workspaceResourceId": "{{workspaceResourceId}}",
62+
"name": "clv2ws1"
7763
}
7864
]
79-
}
65+
},
66+
"dataFlows": [
67+
{
68+
"streams": [
69+
"Custom-QualysVM"
70+
],
71+
"destinations": [
72+
"clv2ws1"
73+
],
74+
"outputStream": "Custom-QualysHostDetectionV3_CL",
75+
"transformKql": "source | extend HostId = tostring(ID), IPAddress = tostring(IP), TrackingMethod = tostring(TRACKING_METHOD), OperatingSystem = tostring(OS['#cdata-section']), DnsName = tostring(DNS['#cdata-section']), NetBios = tostring(NETBIOS['#cdata-section']), QGHostId = tostring(QG_HOSTID['#cdata-section']), LastScanDateTime = todatetime(LAST_SCAN_DATETIME), LastVMScannedDateTime = todatetime(LAST_VM_SCANNED_DATE), LastVMAuthScannedDateTime = todatetime(LAST_VM_AUTH_SCANNED_DATE), DetectionList = DETECTION_LIST, TimeGenerated = now() | project HostId, IPAddress, TrackingMethod, OperatingSystem, DnsName, NetBios, QGHostId, LastScanDateTime, LastVMScannedDateTime, LastVMAuthScannedDateTime, DetectionList, TimeGenerated"
76+
}
77+
]
8078
}
81-
]
79+
}

‎Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_PollingConfig.json‎

Lines changed: 51 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,52 @@
1-
[
2-
{
3-
"type": "Microsoft.SecurityInsights/dataConnectors",
4-
"apiVersion": "2025-03-01",
5-
"name": "QualysVMLogsCCP",
6-
"kind": "RestApiPoller",
7-
"properties": {
8-
"connectorDefinitionName": "QualysVMLogsCCPDefinition",
9-
"dataType": "QualysHostDetectionV3_CL",
10-
"auth": {
11-
"type": "Basic",
12-
"userName": "[[parameters('username')]",
13-
"password": "[[parameters('password')]"
14-
},
15-
"request": {
16-
"apiEndpoint": "{{apiServerUrl}}/api/5.0/fo/asset/host/vm/detection/",
17-
"httpMethod": "GET",
18-
"QueryWindowInMin": 10,
19-
"rateLimitQPS": 1,
20-
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
21-
"headers": {
22-
"X-Requested-With": "XMLHttpRequest",
23-
"User-Agent": "Scuba"
24-
},
25-
"queryParameters": {
26-
"action": "list",
27-
"truncation_limit": "[[parameters('truncationLimit')[0]]",
28-
"status": "New,Fixed,Active,Re-Opened",
29-
"vm_processed_before": "{_QueryWindowEndTime}",
30-
"vm_processed_after": "{_QueryWindowStartTime}"
31-
}
32-
},
33-
"response": {
34-
"eventsJsonPaths": [
35-
"$.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST"
36-
],
37-
"format": "xml"
38-
},
39-
"dcrConfig": {
40-
"streamName": "Custom-QualysVM",
41-
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
42-
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
43-
},
44-
"paging": {
45-
"pagingType": "LinkHeader",
46-
"linkHeaderTokenJsonPath": "$.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL.#cdata-section"
47-
}
48-
}
1+
{
2+
"type": "Microsoft.SecurityInsights/dataConnectors",
3+
"apiVersion": "2025-03-01",
4+
"name": "QualysVMLogsCCP",
5+
"location": "{{location}}",
6+
"kind": "RestApiPoller",
7+
"properties": {
8+
"auth": {
9+
"type": "Basic",
10+
"UserName": "[[parameters('username')]",
11+
"Password": "[[parameters('password')]"
12+
},
13+
"request": {
14+
"apiEndpoint": "[[concat(parameters('apiServerUrl'),'/api/5.0/fo/asset/host/vm/detection/')]",
15+
"httpMethod": "GET",
16+
"rateLimitQPS": 1,
17+
"queryWindowInMin": 10,
18+
"queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
19+
"retryCount": 3,
20+
"timeoutInSeconds": 20,
21+
"headers": {
22+
"X-Requested-With": "XMLHttpRequest",
23+
"User-Agent": "Scuba"
24+
},
25+
"queryParameters": {
26+
"action": "list",
27+
"truncation_limit": "[[parameters('truncationLimit')[0]]",
28+
"status": "New,Fixed,Active,Re-Opened",
29+
"vm_processed_before": "{_QueryWindowEndTime}",
30+
"vm_processed_after": "{_QueryWindowStartTime}",
31+
"show_qds": "[[parameters('show_qds')[0]]"
32+
}
33+
},
34+
"response": {
35+
"eventsJsonPaths": [
36+
"$.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST"
37+
],
38+
"format": "xml"
39+
},
40+
"paging": {
41+
"pagingType": "LinkHeader",
42+
"linkHeaderTokenJsonPath": "$.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL.#cdata-section"
43+
},
44+
"connectorDefinitionName": "QualysVMLogsCCPDefinition",
45+
"dataType": "QualysHostDetectionV3_CL",
46+
"dcrConfig": {
47+
"streamName": "Custom-QualysVM",
48+
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
49+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
4950
}
50-
]
51+
}
52+
}

0 commit comments

Comments
 (0)