Create a new case in TheHive In this section, we create a new case in TheHive as a container for our PDF report. The case must be created first to have a case ID to use to upload the file as an attachment.

Each new report generates a case in TheHive, ensuring that the report is properly attached to the created case for better tracking and organization.

For more information about this endpoint, visit the API quick reference

Fetch reports from Qualys

For more information about this endpoint, visit the API quick reference. The results of the api call are converted from XML to JSON.

Run every hour

The first time the workflow runs, no timestamp will exist in the subworkflow, so it will query all the Qualys scans to generate reports for all of them. Otherwise it will check only for newer scans.

This schedule allows for an organization to create a running export of their reports and store them somewhere operational both for historical purposes and for tracking and accountability purposes.

Set time Stamp

To ensure we do not duplicate data in TheHive, we set a timestamp like a bookmark for every time we run this workflow. We then use the previous timestamp if available to only get the newest scan results from Qualys.

Split out all reports to ensure they are all processed.

When we get the response from Qualys, multiple reports are embedded in the JSON, so we use the split out node to process all the reports at once. Before the reports can be saved however, they must go through a filter, checking the time of creation against the time stamp at the beginning. Any that are newer than the timestamp are copied to TheHive. A wait node is added for a second to ensure that there are no rate request issues when querying TheHive. The timestamp node updates the value in the subworkflow that stores the timestamp value.

Create a new case in TheHive

In this section, we create a new case in TheHive as a container for our PDF report. The case must be created first to have a case ID to use to upload the file as an attachment. Each new report generates a case in TheHive, ensuring that the report is properly attached to the created case for better tracking and organization.

Here we attach the PDF file as an attachment to the Case in TheHive.

This step automates the attachment of the downloaded report to the created case, ensuring all relevant information is consolidated in one place.

Automate Report Generation with n8n & Qualys

Introducing the Save Qualys Reports to TheHive Workflow—a robust solution designed to automate the retrieval and storage of Qualys reports in TheHive.

This workflow fetches reports from Qualys, filters out already processed reports, and creates cases in TheHive for the new reports. It runs every hour to ensure continuous monitoring and up-to-date vulnerability management, making it ideal for Security Operations Centers (SOCs).

How It Works:

• Set Global Variables: Initializes necessary global variables like base_url and newtimestamp. This step ensures that the workflow operates with the correct configuration and up-to-date timestamps. Ensure to change the Global Variables to match your environment.

• Fetch Reports from Qualys: Sends a GET request to the Qualys API to retrieve finished reports. Automating this step ensures timely updates and consistent data retrieval.

• Convert XML to JSON: Converts the XML response to JSON format for easier data manipulation. This transformation simplifies further processing and integration into TheHive.

• Filter Reports: Checks if the reports have already been processed using their creation timestamps. This filtering ensures that only new reports are handled, avoiding duplicates.

• Process Each Report: Loops through the list of new reports, ensuring each is processed individually. This step-by-step handling prevents issues related to bulk processing and improves reliability.

• Create Case in TheHive: Generates a new case in TheHive for each report, serving as a container for the report data. Automating case creation improves efficiency and ensures that all relevant data is captured.

• Download and Attach Report: Downloads the report from Qualys and attaches it to the respective case in TheHive. This automation ensures that all data is properly archived and easily accessible for review.

Get Started:

• Ensure your Qualys and TheHive integrations are properly set up.
• Customize the workflow to fit your specific vulnerability management needs.

Need Help?

• Join the discussion on our Forum or check out resources on Discord!

Deploy this workflow to streamline your vulnerability management process, improve response times, and enhance the efficiency of your security operations.

Fetch reports from Qualys

Purpose and structure

This folder contains the Fetch reports from Qualys workflow. Its executable nodes use executeWorkflow, filter, httpRequest, if, manualTrigger, n8n, scheduleTrigger, set, splitInBatches, splitOut, theHiveProject, wait, xml. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

When clicking "Test workflow", Schedule Trigger

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Wait/0627_Wait_Splitout_Create_Scheduled.json MIT; preserve source notices.