Qualys EDR

Integration version: 1.0

Configure Qualys EDR integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	http://x.x.x.x	Yes	API root of the Qualys EDR instance.
Username	String	N/A	Yes	Username of the Qualys EDR account.
Password	Password	N/A	Yes	Password of the Qualys EDR account.
Verify SSL	Checkbox	Checked	Yes	If enabled, verifies that the SSL certificate for the connection to the Qualys EDR server is valid.

Note: You can make changes at a later stage if needed. Once configured, the Instances can be used in Playbooks. For detailed information on configuring and supporting multiple instances, please see Supporting multiple instances.

Actions

Ping

Description

Test connectivity to Qualys EDR with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Run On

This action doesn't run on entities.

Action Results

Script Result

Script Result Name	Value Options
is_success	is_success=False
is_success	is_success=True

Case Wall

Case	Success	Fail	Message
If successful	true	false	Successfully connected to the Qualys EDR server with the provided connection parameters!
If not successful	false	true	Failed to connect to the Qualys EDR server! Error: {0}".format(exception.stacktrace)

Connector

Qualys EDR - Events Connector

Description

Pull information about events from Qualys EDR.

Configure Qualys EDR - Events Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	Product Name	Yes	Enter the source field name in order to retrieve the Product Field name.
Event Field Name	String	Type	Yes	Enter the source field name in order to retrieve the Event Field name.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regex pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field via regex logic. If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
API Root	String	N/A	Yes	API root of the Qualys EDR instance.
Username	String	N/A	Yes	Username of the Qualys EDR account.
Password	String	N/A	Yes	Password of the Qualys EDR account.
Lowest Score To Fetch	Integer	5	False	Lowest Score that needs to be used to fetch events. Maximum: 10. If nothing is specified, connector will ingest events with all scores.
Type Filter	CSV	file, network	Yes	Type filter for the events. Possible values: file,mutex,process,network,registry.
Max Hours Backwards	Integer	1	No	Amount of hours from where to fetch events.
Max Events To Fetch	Integer	100	No	How many alert logs to process per one connector iteration. Default: 100.
Use whitelist as a blacklist	Checkbox	Checked	Yes	If enabled, whitelist will be used as a blacklist.
Verify SSL	Checkbox	Checked	Yes	If enabled, verify the SSL certificate for the connection to the Qualys EDR server is valid.
Proxy Server Address	String	N/A	No	The address of the proxy server to use.
Proxy Username	String	N/A	No	The proxy username to authenticate with.
Proxy Password	Password	N/A	No	The proxy password to authenticate with.

Connector rules

Proxy support

The connector supports Proxy.