Qualys Fetch Vulnerabilities - Include all vulnerabilities on assets

[johnnywilkes]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• [] In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

https://jira-dc.paloaltonetworks.com/browse/EXPANDR-10862

Description

Proposed change is making sure we not only pull Qualys vulnerabilities modified in the last 90 days but also those that are affecting assets that haven’t been modified in the last 90 days. This is to make sure this isn’t a breaking change.
How we do this:

1. Every time assets are pulled create a list of vulnerabilities (QIDs) we see on them.
2. Deduplicate this list.
3. Add the list to getAssetsLastRun()
4. When we lookup vulnerabilities, first do the call to pull all vulnerabilities modified in last 90 days and create list of these QIDs
5. Compare list from steps 3 and 4 and deduplicate (create a list of QIDs found on assets that haven’t been modified for last 90 days)
6. 2nd API call to pull these vulnerabilities that hadn’t been pulled before
7. Send full list of vulnerabilties to XSIAM

Must have

• Tests
• Documentation

[johnnywilkes]

@ShirleyDenkberg , please review when possible

[ShirleyDenkberg]

@aaron1535 Doc review completed.

[aaron1535]

Hi @johnnywilkes
Thank you for your contribution.
Nice job!
Please correct my comment and we can merge

[johnnywilkes]

@aaron1535 , thank you. Merge when possible, please

[github-actions]

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.