diff --git a/packages/qualys_gav/_dev/build/docs/README.md b/packages/qualys_gav/_dev/build/docs/README.md index c30b389ee30..049ef004eb7 100644 --- a/packages/qualys_gav/_dev/build/docs/README.md +++ b/packages/qualys_gav/_dev/build/docs/README.md @@ -45,6 +45,19 @@ For Rest API, this module has been tested against the **2.0** API version. 4. Add all the required integration configuration parameters: URL, Username and Password. 5. Save the integration. +### Query-time asset enrichment (LOOKUP JOIN) + +When the integration is installed, a transform maintains the latest asset inventory per host in a lookup index (`logs-qualys_gav_latest.asset`). You can enrich other Qualys or security data with GAV asset metadata at query time using ES|QL [`LOOKUP JOIN`](https://www.elastic.co/docs/reference/query-languages/esql/commands/lookup-join) on `host.id`. + +Example enriching Qualys VMDR vulnerability data with GAV asset inventory: + +```esql +FROM security_solution-qualys_vmdr.vulnerability_latest +| LOOKUP JOIN logs-qualys_gav_latest.asset ON host.id +``` + +**Elasticsearch 9.1+** is required for `LOOKUP JOIN` against a lookup index. On releases before 9.1, `LOOKUP JOIN` must target the concrete transform destination index instead: in Kibana go to **Stack Management** → **Transforms**, open the Qualys GAV latest asset transform, and use the **destination_index** name shown there (that name can change with the integration version). + ## Logs reference ### Asset diff --git a/packages/qualys_gav/changelog.yml b/packages/qualys_gav/changelog.yml index fa06b7f7e32..fa656ad385d 100644 --- a/packages/qualys_gav/changelog.yml +++ b/packages/qualys_gav/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.9.0" + changes: + - description: Configure the latest-asset transform destination with lookup index mode so it can be used as the right-hand side of ES|QL LOOKUP JOIN. + type: enhancement + link: https://github.com/elastic/integrations/issues/20067 - version: "0.8.0" changes: - description: Use new `release` field for agentless deployment mode to establish as beta. diff --git a/packages/qualys_gav/data_stream/asset/sample_event.json b/packages/qualys_gav/data_stream/asset/sample_event.json index 5dff2d06a83..718ec56ddc6 100644 --- a/packages/qualys_gav/data_stream/asset/sample_event.json +++ b/packages/qualys_gav/data_stream/asset/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2026-02-04T06:51:04.303Z", + "@timestamp": "2026-07-09T16:29:57.967Z", "agent": { - "ephemeral_id": "84bef4d7-6655-4314-ab61-70bd9fcda95c", - "id": "af53695e-5439-403d-b188-6d5a79dfcdce", - "name": "elastic-agent-48336", + "ephemeral_id": "62c8b2f5-aba3-4e9b-be8c-8e56e0c4ffa7", + "id": "301b6745-acbc-4753-a4df-275b7bae6af3", + "name": "elastic-agent-67472", "type": "filebeat", - "version": "8.19.11" + "version": "9.4.3" }, "cloud": { "account": { @@ -27,7 +27,7 @@ }, "data_stream": { "dataset": "qualys_gav.asset", - "namespace": "78517", + "namespace": "59070", "type": "logs" }, "device": { @@ -40,9 +40,9 @@ "version": "8.17.0" }, "elastic_agent": { - "id": "af53695e-5439-403d-b188-6d5a79dfcdce", + "id": "301b6745-acbc-4753-a4df-275b7bae6af3", "snapshot": false, - "version": "8.19.11" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", @@ -51,9 +51,9 @@ ], "created": "2025-07-09T14:21:12.000Z", "dataset": "qualys_gav.asset", - "ingested": "2026-02-04T06:51:07Z", + "ingested": "2026-07-09T16:30:00Z", "kind": "event", - "original": "{\"activity\":{\"lastScannedDate\":1752243670000,\"source\":\"EASM\"},\"address\":\"216.160.83.56\",\"agent\":{\"activations\":[{\"key\":\"httpd\",\"status\":\"ACTIVE\"}],\"configurationProfile\":\"Apache HTTP Server\",\"connectedFrom\":\"216.160.83.56\",\"errorStatus\":false,\"lastActivity\":1752520814000,\"lastCheckedIn\":1752520814000,\"lastInventory\":1752520816000,\"udcManifestAssigned\":false,\"version\":\"2.4.7\"},\"agentId\":\"bda51f1d-13cf-49ad-a3a0-9f83debbe5a9\",\"asn\":\"AS53831\",\"assetId\":67533741,\"assetName\":\"test_asset\",\"assetType\":\"HOST\",\"assetUUID\":\"bda51f1d-13cf-49ad-a3a0-9f83debbe5a9\",\"assignedLocation\":{\"city\":\"Pune\",\"country\":\"IN\",\"name\":\"4492 Camino De La Plaza, Pune,IN\",\"state\":\"MH\"},\"biosAssetTag\":\"Test asset tag\",\"biosDescription\":\"Test\",\"biosSerialNumber\":\"Test serial number\",\"businessAppListData\":{\"businessApp\":[{\"businessCriticality\":\"2 - Less Critical\",\"environment\":\"Production\",\"id\":\"BARCODE283904\",\"managedBy\":\"user\",\"name\":\"Quoting App\",\"operationalStatus\":\"Mended\",\"ownedBy\":\"ownerr\",\"status\":\"Installed\",\"supportGroup\":\"SME Operations\",\"supportedBy\":\"sopporter\",\"usedFor\":\"Production\"}]},\"businessInformation\":{\"company\":\"Qualys\",\"department\":\"Engineering\",\"environment\":\"QA\",\"managedBy\":\"Amit\",\"operationalStatus\":\"Blocked\",\"ownedBy\":\"Paul\",\"supportGroup\":\"ABC_01\",\"supportedBy\":\"Nick\"},\"cloudProvider\":{\"alibaba\":null,\"aws\":{\"ec2\":{\"accountId\":\"1234\",\"availabilityZone\":\"us-west-2a\",\"hasAgent\":true,\"hostname\":\"hostname_value\",\"imageId\":\"imageId_value\",\"instanceId\":\"instanceId_value\",\"instanceState\":\"RUNNING\",\"instanceType\":\"m4.large\",\"kernelId\":null,\"launchdate\":1653386892000,\"privateDNS\":\"privateDNS_value\",\"privateIpAddress\":\"10.0.0.1\",\"publicDNS\":null,\"publicIpAddress\":\"175.16.199.1\",\"qualysScanner\":false,\"region\":{\"code\":\"us-west-2\",\"name\":\"US West (Oregon)\"},\"spotInstance\":false,\"subnetId\":\"subnetId_value\",\"vpcId\":\"vpcId_value\"},\"tags\":[{\"key\":\"tags_key_1\",\"value\":\"tags_value_1\"},{\"key\":\"tags_key_2\",\"value\":\"tags_value_2\"}]},\"azure\":null,\"gcp\":null,\"ibm\":null,\"oci\":null},\"container\":{\"hasSensor\":\"temp_value\",\"noOfContainers\":5,\"noOfImages\":3,\"product\":\"mock_product\",\"version\":\"mock_version\"},\"cpuCount\":0,\"createdDate\":\"2025-07-09T14:21:12.000Z\",\"criticality\":{\"isDefault\":false,\"lastUpdated\":\"2025-07-09T14:21:11.000Z\",\"score\":3},\"customAttributes\":[{\"connectorName\":\"Qualys\",\"key\":\"Media State4\",\"value\":\"Media disconnected\"}],\"dnsName\":\"test_dns\",\"domain\":[\"domain1\",\"domain2\"],\"domainRole\":\"Member Workstation\",\"easmTags\":[\"cloud\",\"cdn\"],\"hardware\":{\"category\":\"Mock category 1 / Mock category 2\",\"category1\":\"Mock category 1\",\"category2\":\"Mock category 2\",\"fullName\":\"Mock hardware\",\"lifecycle\":{\"eosDate\":\"2025-07-09T14:21:12.000Z\",\"gaDate\":\"2025-07-09T14:21:12.000Z\",\"introDate\":\"2025-07-09T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"obsoleteDate\":\"2025-07-09T14:21:12.000Z\",\"stage\":\"Not Applicable\"},\"manufacturer\":\"Mock manufacturer\",\"model\":\"Mock model\",\"productFamily\":\"Mock product family\",\"productName\":\"Mock product name\",\"productUrl\":\"https://mock_product_url.com\",\"taxonomy\":{\"category1\":\"Mock category 1\",\"category2\":\"Mock category 2\",\"id\":\"mock_hardware_taxonomy_id\",\"name\":\"Mock hardware taxonomy name\"}},\"hostId\":1437386,\"hostingCategory1\":\"CDN\",\"hwUUID\":\"422a2b16-4c8b-588a-a20c-c1851ad7e376\",\"inventory\":{\"created\":1752070872000,\"lastUpdated\":1752243670000,\"source\":\"EASM\"},\"inventory_list_data\":{\"inventory\":[{\"created\":\"2024-01-12T03:40:12.000Z\",\"last_updated\":\"2025-11-04T08:08:04.000Z\",\"source\":\"EASM\"}]},\"isContainerHost\":false,\"isp\":\"test, Inc.\",\"lastBoot\":\"2025-07-09T14:21:12.000Z\",\"lastLocation\":{\"city\":\"New York\",\"continent\":\"North America\",\"country\":\"United States\",\"name\":\"United States\",\"postal\":\"94040\",\"state\":\"California\"},\"lastLoggedOnUser\":\"test_user\",\"lastModifiedDate\":\"2025-07-11T14:21:10.000Z\",\"lparId\":\"mock_lpar_id\",\"missingSoftware\":[\"test1\",\"test2\",\"test3\"],\"netbiosName\":\"test_bios\",\"networkInterfaceListData\":{\"networkInterface\":[{\"addressIpV4\":\"81.2.69.142\",\"addressIpV6\":\"::ffff:5102:458e\",\"addresses\":\"mock_Address\",\"dnsAddress\":\"mock_dns_address\",\"gatewayAddress\":\"mock_geteaway_address\",\"hostname\":\"mock_hostname\",\"interfaceName\":\"mock_interface_name\",\"macAddress\":\"00:0c:29:15:6a:72\",\"macVendorIntroDate\":946944000000,\"manufacturer\":\"Mock manufacturer\",\"netmask\":\"mock_net_mask\"}]},\"openPortListData\":{\"openPort\":[{\"authorization\":\"Mock authorization\",\"description\":\"http protocol over TLS/SSL\",\"detectedService\":\"HTTPs\",\"detectionScore\":100,\"discoverySources\":\"EASM\",\"firstFound\":\"2025-07-09T14:21:12.000Z\",\"lastUpdated\":\"2025-07-09T14:21:12.000Z\",\"port\":443,\"protocol\":\"TCP\"}]},\"operatingSystem\":{\"architecture\":\"x86\",\"category\":\"Operating System / Windows\",\"category1\":\"Windows\",\"category2\":\"Windows\",\"cpe\":\"mock_cpe\",\"cpeId\":\"mock_cpe_id\",\"cpeType\":\"Mock cpe type\",\"edition\":\"Enterprise\",\"fullName\":\"Microsoft Windows 10 Enterprise\",\"installDate\":\"2025-07-09T14:21:12.000Z\",\"lifecycle\":{\"detectionScore\":100,\"eolDate\":\"2025-07-09T14:21:12.000Z\",\"eolSupportStage\":\"End-of-life\",\"eosDate\":\"2025-07-09T14:21:12.000Z\",\"eosSupportStage\":\"End-of-life\",\"gaDate\":\"2025-07-09T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"stage\":\"End-of-life\"},\"marketVersion\":\"10.0.19042.1052\",\"osName\":\"Windows 10\",\"productFamily\":\"Mock product family\",\"productName\":\"Microsoft Windows 10 Enterprise\",\"productUrl\":\"https://mock_product_url.com\",\"publisher\":\"test\",\"release\":\"Mock release\",\"taxonomy\":{\"category1\":\"Mock category1\",\"category2\":\"Mock category2\",\"id\":\"mock_taxonomy_id\",\"name\":\"Mock taxonomy name\"},\"update\":\"22.04 LTS 22.04.5 LTS\",\"version\":\"10.0.19042.1052\"},\"organizationName\":[\"mock\"],\"processor\":{\"coresPerSocket\":2,\"description\":\"Intel(R) Xeon(R) Gold 6430\",\"multithreadingStatus\":\"test\",\"noOfSocket\":2,\"numCPUs\":4,\"speed\":3200,\"threadsPerCore\":2},\"provider\":\"AWS\",\"riskScore\":0,\"sensor\":{\"activatedForModules\":[\"mock_activated_module\"],\"firstEasmScanDate\":1752243670000,\"lastComplianceScan\":0,\"lastEasmScanDate\":1752243670000,\"lastFullScan\":0,\"lastPcScanDateAgent\":0,\"lastPcScanDateScanner\":0,\"lastVMScan\":0,\"lastVmScanDateAgent\":0,\"lastVmScanDateScanner\":0,\"pendingActivationForModules\":[\"mock_pending_module\"]},\"sensorLastUpdatedDate\":\"2025-07-11T14:21:10.000Z\",\"serviceList\":{\"service\":[{\"description\":\"temp_Decp\",\"name\":\"systemd-networkd.service\",\"status\":\"loaded/active/running\"}]},\"softwareComponent\":\"Apache HTTP Server\",\"softwareListData\":{\"software\":[{\"architecture\":\"x86_64\",\"authorization\":\"Mock authorization\",\"authorizationDetectionScore\":5,\"category\":\"Network Application / Web Servers\",\"category1\":\"Network Application\",\"category2\":\"Web Servers\",\"component\":\"Server\",\"cpe\":\"mock_cpe\",\"cpeId\":\"mock_cpe_id\",\"cpeType\":\"Mock cpe type\",\"discoveredName\":\"Mock discovered name\",\"discoveredPublisher\":\"Mock discovered publisher\",\"discoveredVersion\":\"mock_version\",\"discoverySources\":\"EASM\",\"edition\":\"Unknown\",\"formerlyKnownAs\":\"httpd\",\"fullName\":\"Apache HTTP Server\",\"id\":8464359598295418000,\"ignoredReason\":\"Insufficient Information\",\"installDate\":\"2021-10-25T14:21:12.000Z\",\"installPath\":\"/usr/local/apache2\",\"isIgnored\":false,\"isPackage\":false,\"isPackageComponent\":false,\"language\":\"C\",\"lastUpdated\":\"2021-10-25T14:21:12.000Z\",\"lastUseDate\":\"2021-10-25T14:21:12.000Z\",\"license\":{\"category\":\"Mock license category\",\"subcategory\":\"Mock license subcategory\"},\"lifecycle\":{\"detectionScore\":0,\"eolDate\":\"2021-10-25T14:21:12.000Z\",\"eolSupportStage\":\"Mock eol support stage\",\"eosDate\":\"2021-10-25T14:21:12.000Z\",\"eosSupportStage\":\"Mock eos support stage\",\"gaDate\":\"2021-10-25T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"stage\":\"Not Applicable\"},\"marketVersion\":\"Unknown\",\"packageName\":null,\"productName\":\"Apache HTTP Server\",\"productUrl\":\"https://en.wikipedia.org/wiki/Apache_HTTP_Server,,\",\"publisher\":\"Apache\",\"softwareInstances\":[{\"BIN_PATH\":\"/usr/bin/docker -H unix:///var/run/docker.sock\",\"CONF_PATH\":\"/etc/docker/daemon.json\",\"InstanceName\":\"DOCKER\",\"PROC\":\" 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock\",\"PRODUCT\":\"Docker\",\"TECHNOLOGY\":\"Docker CE_EE\",\"VERSION\":\"24.0.7\",\"firstSeen\":\"2025-07-08T01:15:52.000Z\",\"lastSeen\":\"2025-07-14T19:20:15.000Z\"}],\"softwareType\":\"Application\",\"supportStageDesc\":\"Mock support stage desc\",\"update\":\"2021-10-25\",\"version\":\"2.4.7\"}]},\"subdomain\":[\"subdomain1\",\"subdomain2\"],\"tagList\":{\"tag\":[{\"backgroundColor\":0,\"businessImpact\":\"mock_business_impact\",\"criticalityScore\":3,\"foregroundColor\":0,\"tagId\":25971788,\"tagName\":\"Shodan\"}]},\"timeZone\":\"+05:30\",\"totalMemory\":10,\"userAccountListData\":{\"userAccount\":[{\"name\":\"root\"},{\"name\":\"serviceuser\"},{\"name\":\"devuser\"}]},\"volumeListData\":{\"volume\":[{\"free\":34645118976,\"name\":\"/\",\"size\":48202350592}]},\"whois\":[{\"createdDate\":\"2024-02-23T00:00:00.000Z\",\"dnssec\":\"test\",\"domain\":\"test_domainr\",\"domainStatus\":\"clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited\",\"expirationDate\":\"2026-02-23T00:00:00.000Z\",\"registrantContact\":\"temp\",\"registrantCountry\":\"UNITED STATES\",\"registrantEmail\":\"594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com\",\"registrantName\":\"1API GmbH\",\"registrantOrganization\":\"Domains By Proxy, LLC\",\"registrar\":\"1API GmbH\",\"updatedDate\":\"2025-07-13T00:00:00.000Z\"}]}", + "module": "qualys_gav", "risk_score": 0, "timezone": "+05:30", "type": [ @@ -91,38 +91,23 @@ "input": { "type": "cel" }, + "labels": { + "is_transform_source": "true" + }, "observer": { "product": "Global AssetView", "vendor": "Qualys" }, "package": { - "architecture": [ - "x86_64" - ], - "description": [ - "Mock support stage desc" - ], - "installed": [ - "2021-10-25T14:21:12.000Z" - ], - "license": [ - "Mock license category" - ], - "name": [ - "Apache HTTP Server" - ], - "path": [ - "/usr/local/apache2" - ], - "reference": [ - "https://en.wikipedia.org/wiki/Apache_HTTP_Server,," - ], - "type": [ - "Application" - ], - "version": [ - "2.4.7" - ] + "architecture": "x86_64", + "description": "Mock support stage desc", + "installed": "2021-10-25T14:21:12.000Z", + "license": "Mock license category", + "name": "Apache HTTP Server", + "path": "/usr/local/apache2", + "reference": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", + "type": "Application", + "version": "2.4.7" }, "qualys_gav": { "asset": { @@ -132,12 +117,10 @@ }, "address": "216.160.83.56", "agent": { - "activations": [ - { - "key": "httpd", - "status": "ACTIVE" - } - ], + "activations": { + "key": "httpd", + "status": "ACTIVE" + }, "configuration_profile": "Apache HTTP Server", "connected_from": "216.160.83.56", "error_status": false, @@ -163,21 +146,19 @@ "bios_description": "Test", "bios_serial_number": "Test serial number", "business_app_list_data": { - "business_app": [ - { - "business_criticality": "2 - Less Critical", - "environment": "Production", - "id": "BARCODE283904", - "managed_by": "user", - "name": "Quoting App", - "operational_status": "Mended", - "owned_by": "ownerr", - "status": "Installed", - "support_group": "SME Operations", - "supported_by": "sopporter", - "used_for": "Production" - } - ] + "business_app": { + "business_criticality": "2 - Less Critical", + "environment": "Production", + "id": "BARCODE283904", + "managed_by": "user", + "name": "Quoting App", + "operational_status": "Mended", + "owned_by": "ownerr", + "status": "Installed", + "support_group": "SME Operations", + "supported_by": "sopporter", + "used_for": "Production" + } }, "business_information": { "company": "Qualys", @@ -213,16 +194,16 @@ "subnet_id": "subnetId_value", "vpc_id": "vpcId_value" }, - "tags": [ - { - "key": "tags_key_1", - "value": "tags_value_1" - }, - { - "key": "tags_key_2", - "value": "tags_value_2" - } - ] + "tags": { + "key": [ + "tags_key_1", + "tags_key_2" + ], + "value": [ + "tags_value_1", + "tags_value_2" + ] + } } }, "container": { @@ -239,13 +220,11 @@ "last_updated": "2025-07-09T14:21:11.000Z", "score": 3 }, - "custom_attributes": [ - { - "connector_name": "Qualys", - "key": "Media State4", - "value": "Media disconnected" - } - ], + "custom_attributes": { + "connector_name": "Qualys", + "key": "Media State4", + "value": "Media disconnected" + }, "dns_name": "test_dns", "domain": [ "domain1", @@ -284,21 +263,19 @@ "host_id": "1437386", "hosting_category1": "CDN", "hw_uuid": "422a2b16-4c8b-588a-a20c-c1851ad7e376", - "interval_id": "da729d8d-7a83-44c4-b528-58e6712bff6e", - "interval_start": "2026-02-04T06:51:04.300Z", + "interval_id": "425283cc-3c3d-4629-a7d1-bdf5d1c0a6eb", + "interval_start": "2026-07-09T16:29:57.964Z", "inventory": { "created": "2025-07-09T14:21:12.000Z", "last_updated": "2025-07-11T14:21:10.000Z", "source": "EASM" }, "inventory_list_data": { - "inventory": [ - { - "created": "2024-01-12T03:40:12.000Z", - "last_updated": "2025-11-04T08:08:04.000Z", - "source": "EASM" - } - ] + "inventory": { + "created": "2024-01-12T03:40:12.000Z", + "last_updated": "2025-11-04T08:08:04.000Z", + "source": "EASM" + } }, "is_container_host": false, "isp": "test, Inc.", @@ -321,40 +298,32 @@ ], "netbios_name": "test_bios", "network_interface_list_data": { - "network_interface": [ - { - "address_ip_v4": [ - "81.2.69.142" - ], - "address_ip_v6": [ - "::ffff:5102:458e" - ], - "addresses": "mock_Address", - "dns_address": "mock_dns_address", - "gateway_address": "mock_geteaway_address", - "hostname": "mock_hostname", - "interface_name": "mock_interface_name", - "mac_address": "00-0C-29-15-6A-72", - "mac_vendor_intro_date": "2000-01-04T00:00:00.000Z", - "manufacturer": "Mock manufacturer", - "netmask": "mock_net_mask" - } - ] + "network_interface": { + "address_ip_v4": "81.2.69.142", + "address_ip_v6": "81.2.69.142", + "addresses": "mock_Address", + "dns_address": "mock_dns_address", + "gateway_address": "mock_geteaway_address", + "hostname": "mock_hostname", + "interface_name": "mock_interface_name", + "mac_address": "00-0C-29-15-6A-72", + "mac_vendor_intro_date": "2000-01-04T00:00:00.000Z", + "manufacturer": "Mock manufacturer", + "netmask": "mock_net_mask" + } }, "open_port_list_data": { - "open_port": [ - { - "authorization": "Mock authorization", - "description": "http protocol over TLS/SSL", - "detected_service": "HTTPs", - "detection_score": 100, - "discovery_sources": "EASM", - "first_found": "2025-07-09T14:21:12.000Z", - "last_updated": "2025-07-09T14:21:12.000Z", - "port": 443, - "protocol": "TCP" - } - ] + "open_port": { + "authorization": "Mock authorization", + "description": "http protocol over TLS/SSL", + "detected_service": "HTTPs", + "detection_score": 100, + "discovery_sources": "EASM", + "first_found": "2025-07-09T14:21:12.000Z", + "last_updated": "2025-07-09T14:21:12.000Z", + "port": 443, + "protocol": "TCP" + } }, "operating_system": { "architecture": "x86", @@ -393,9 +362,7 @@ "update": "22.04 LTS 22.04.5 LTS", "version": "10.0.19042.1052" }, - "organization_name": [ - "mock" - ], + "organization_name": "mock", "processor": { "cores_per_socket": 2, "description": "Intel(R) Xeon(R) Gold 6430", @@ -408,109 +375,97 @@ "provider": "AWS", "risk_score": 0, "sensor": { - "activated_for_modules": [ - "mock_activated_module" - ], + "activated_for_modules": "mock_activated_module", "first_easm_scan_date": "2025-07-11T14:21:10.000Z", "last_easm_scan_date": "2025-07-11T14:21:10.000Z", - "pending_activation_for_modules": [ - "mock_pending_module" - ] + "pending_activation_for_modules": "mock_pending_module" }, "sensor_last_updated_date": "2025-07-11T14:21:10.000Z", "service_list": { - "service": [ - { - "description": "temp_Decp", - "name": "systemd-networkd.service", - "status": "loaded/active/running" - } - ] + "service": { + "description": "temp_Decp", + "name": "systemd-networkd.service", + "status": "loaded/active/running" + } }, "software_component": "Apache HTTP Server", "software_list_data": { - "software": [ - { - "architecture": "x86_64", - "authorization": "Mock authorization", - "authorization_detection_score": 5, - "category": "Network Application / Web Servers", - "category1": "Network Application", - "category2": "Web Servers", - "component": "Server", - "cpe": "mock_cpe", - "cpe_id": "mock_cpe_id", - "cpe_type": "Mock cpe type", - "discovered_name": "Mock discovered name", - "discovered_publisher": "Mock discovered publisher", - "discovered_version": "mock_version", - "discovery_sources": "EASM", - "edition": "Unknown", - "formerly_known_as": "httpd", - "full_name": "Apache HTTP Server", - "id": "8464359598295418000", - "ignored_reason": "Insufficient Information", - "install_date": "2021-10-25T14:21:12.000Z", - "install_path": "/usr/local/apache2", - "is_ignored": false, - "is_package": false, - "is_package_component": false, - "language": "C", - "last_updated": "2021-10-25T14:21:12.000Z", - "last_use_date": "2021-10-25T14:21:12.000Z", - "license": { - "category": "Mock license category", - "subcategory": "Mock license subcategory" - }, - "lifecycle": { - "detection_score": 0, - "eol_date": "2021-10-25T14:21:12.000Z", - "eol_support_stage": "Mock eol support stage", - "eos_date": "2021-10-25T14:21:12.000Z", - "eos_support_stage": "Mock eos support stage", - "ga_date": "2021-10-25T14:21:12.000Z", - "life_cycle_confidence": "Exact", - "stage": "Not Applicable" - }, - "market_version": "Unknown", - "product_name": "Apache HTTP Server", - "product_url": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", - "publisher": "Apache", - "software_instances": [ - { - "bin_path": "/usr/bin/docker -H unix:///var/run/docker.sock", - "conf_path": "/etc/docker/daemon.json", - "first_seen": "2025-07-08T01:15:52.000Z", - "instance_name": "DOCKER", - "last_seen": "2025-07-14T19:20:15.000Z", - "proc": " 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock", - "product": "Docker", - "technology": "Docker CE_EE", - "version": "24.0.7" - } - ], - "software_type": "Application", - "support_stage_desc": "Mock support stage desc", - "update": "2021-10-25", - "version": "2.4.7" - } - ] + "software": { + "architecture": "x86_64", + "authorization": "Mock authorization", + "authorization_detection_score": 5, + "category": "Network Application / Web Servers", + "category1": "Network Application", + "category2": "Web Servers", + "component": "Server", + "cpe": "mock_cpe", + "cpe_id": "mock_cpe_id", + "cpe_type": "Mock cpe type", + "discovered_name": "Mock discovered name", + "discovered_publisher": "Mock discovered publisher", + "discovered_version": "mock_version", + "discovery_sources": "EASM", + "edition": "Unknown", + "formerly_known_as": "httpd", + "full_name": "Apache HTTP Server", + "id": "8464359598295418000", + "ignored_reason": "Insufficient Information", + "install_date": "2021-10-25T14:21:12.000Z", + "install_path": "/usr/local/apache2", + "is_ignored": false, + "is_package": false, + "is_package_component": false, + "language": "C", + "last_updated": "2021-10-25T14:21:12.000Z", + "last_use_date": "2021-10-25T14:21:12.000Z", + "license": { + "category": "Mock license category", + "subcategory": "Mock license subcategory" + }, + "lifecycle": { + "detection_score": 0, + "eol_date": "2021-10-25T14:21:12.000Z", + "eol_support_stage": "Mock eol support stage", + "eos_date": "2021-10-25T14:21:12.000Z", + "eos_support_stage": "Mock eos support stage", + "ga_date": "2021-10-25T14:21:12.000Z", + "life_cycle_confidence": "Exact", + "stage": "Not Applicable" + }, + "market_version": "Unknown", + "product_name": "Apache HTTP Server", + "product_url": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", + "publisher": "Apache", + "software_instances": { + "bin_path": "/usr/bin/docker -H unix:///var/run/docker.sock", + "conf_path": "/etc/docker/daemon.json", + "first_seen": "2025-07-08T01:15:52.000Z", + "instance_name": "DOCKER", + "last_seen": "2025-07-14T19:20:15.000Z", + "proc": " 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock", + "product": "Docker", + "technology": "Docker CE_EE", + "version": "24.0.7" + }, + "software_type": "Application", + "support_stage_desc": "Mock support stage desc", + "update": "2021-10-25", + "version": "2.4.7" + } }, "subdomain": [ "subdomain1", "subdomain2" ], "tag_list": { - "tag": [ - { - "background_color": "0", - "business_impact": "mock_business_impact", - "criticality_score": 3, - "foreground_color": "0", - "tag_id": "25971788", - "tag_name": "Shodan" - } - ] + "tag": { + "background_color": "0", + "business_impact": "mock_business_impact", + "criticality_score": 3, + "foreground_color": "0", + "tag_id": "25971788", + "tag_name": "Shodan" + } }, "time_zone": "+05:30", "total_memory": 10, @@ -528,30 +483,26 @@ ] }, "volume_list_data": { - "volume": [ - { - "free": 34645118976, - "name": "/", - "size": 48202350592 - } - ] - }, - "whois": [ - { - "created_date": "2024-02-23T00:00:00.000Z", - "dnssec": "test", - "domain": "test_domainr", - "domain_status": "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited", - "expiration_date": "2026-02-23T00:00:00.000Z", - "registrant_contact": "REDACTED", - "registrant_country": "UNITED STATES", - "registrant_email": "594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com", - "registrant_name": "1API GmbH", - "registrant_organization": "Domains By Proxy, LLC", - "registrar": "1API GmbH", - "updated_date": "2025-07-13T00:00:00.000Z" + "volume": { + "free": 34645118976, + "name": "/", + "size": 48202350592 } - ] + }, + "whois": { + "created_date": "2024-02-23T00:00:00.000Z", + "dnssec": "test", + "domain": "test_domainr", + "domain_status": "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited", + "expiration_date": "2026-02-23T00:00:00.000Z", + "registrant_contact": "REDACTED", + "registrant_country": "UNITED STATES", + "registrant_email": "594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com", + "registrant_name": "1API GmbH", + "registrant_organization": "Domains By Proxy, LLC", + "registrar": "1API GmbH", + "updated_date": "2025-07-13T00:00:00.000Z" + } } }, "related": { @@ -572,7 +523,7 @@ "ip": [ "216.160.83.56", "81.2.69.142", - "::ffff:5102:458e" + "81.2.69.142" ], "user": [ "test_user" diff --git a/packages/qualys_gav/docs/README.md b/packages/qualys_gav/docs/README.md index 0383fbd1341..2ba597cd7a9 100644 --- a/packages/qualys_gav/docs/README.md +++ b/packages/qualys_gav/docs/README.md @@ -45,6 +45,19 @@ For Rest API, this module has been tested against the **2.0** API version. 4. Add all the required integration configuration parameters: URL, Username and Password. 5. Save the integration. +### Query-time asset enrichment (LOOKUP JOIN) + +When the integration is installed, a transform maintains the latest asset inventory per host in a lookup index (`logs-qualys_gav_latest.asset`). You can enrich other Qualys or security data with GAV asset metadata at query time using ES|QL [`LOOKUP JOIN`](https://www.elastic.co/docs/reference/query-languages/esql/commands/lookup-join) on `host.id`. + +Example enriching Qualys VMDR vulnerability data with GAV asset inventory: + +```esql +FROM security_solution-qualys_vmdr.vulnerability_latest +| LOOKUP JOIN logs-qualys_gav_latest.asset ON host.id +``` + +**Elasticsearch 9.1+** is required for `LOOKUP JOIN` against a lookup index. On releases before 9.1, `LOOKUP JOIN` must target the concrete transform destination index instead: in Kibana go to **Stack Management** → **Transforms**, open the Qualys GAV latest asset transform, and use the **destination_index** name shown there (that name can change with the integration version). + ## Logs reference ### Asset @@ -57,13 +70,13 @@ An example event for `asset` looks as following: ```json { - "@timestamp": "2026-02-04T06:51:04.303Z", + "@timestamp": "2026-07-09T16:29:57.967Z", "agent": { - "ephemeral_id": "84bef4d7-6655-4314-ab61-70bd9fcda95c", - "id": "af53695e-5439-403d-b188-6d5a79dfcdce", - "name": "elastic-agent-48336", + "ephemeral_id": "62c8b2f5-aba3-4e9b-be8c-8e56e0c4ffa7", + "id": "301b6745-acbc-4753-a4df-275b7bae6af3", + "name": "elastic-agent-67472", "type": "filebeat", - "version": "8.19.11" + "version": "9.4.3" }, "cloud": { "account": { @@ -85,7 +98,7 @@ An example event for `asset` looks as following: }, "data_stream": { "dataset": "qualys_gav.asset", - "namespace": "78517", + "namespace": "59070", "type": "logs" }, "device": { @@ -98,9 +111,9 @@ An example event for `asset` looks as following: "version": "8.17.0" }, "elastic_agent": { - "id": "af53695e-5439-403d-b188-6d5a79dfcdce", + "id": "301b6745-acbc-4753-a4df-275b7bae6af3", "snapshot": false, - "version": "8.19.11" + "version": "9.4.3" }, "event": { "agent_id_status": "verified", @@ -109,9 +122,9 @@ An example event for `asset` looks as following: ], "created": "2025-07-09T14:21:12.000Z", "dataset": "qualys_gav.asset", - "ingested": "2026-02-04T06:51:07Z", + "ingested": "2026-07-09T16:30:00Z", "kind": "event", - "original": "{\"activity\":{\"lastScannedDate\":1752243670000,\"source\":\"EASM\"},\"address\":\"216.160.83.56\",\"agent\":{\"activations\":[{\"key\":\"httpd\",\"status\":\"ACTIVE\"}],\"configurationProfile\":\"Apache HTTP Server\",\"connectedFrom\":\"216.160.83.56\",\"errorStatus\":false,\"lastActivity\":1752520814000,\"lastCheckedIn\":1752520814000,\"lastInventory\":1752520816000,\"udcManifestAssigned\":false,\"version\":\"2.4.7\"},\"agentId\":\"bda51f1d-13cf-49ad-a3a0-9f83debbe5a9\",\"asn\":\"AS53831\",\"assetId\":67533741,\"assetName\":\"test_asset\",\"assetType\":\"HOST\",\"assetUUID\":\"bda51f1d-13cf-49ad-a3a0-9f83debbe5a9\",\"assignedLocation\":{\"city\":\"Pune\",\"country\":\"IN\",\"name\":\"4492 Camino De La Plaza, Pune,IN\",\"state\":\"MH\"},\"biosAssetTag\":\"Test asset tag\",\"biosDescription\":\"Test\",\"biosSerialNumber\":\"Test serial number\",\"businessAppListData\":{\"businessApp\":[{\"businessCriticality\":\"2 - Less Critical\",\"environment\":\"Production\",\"id\":\"BARCODE283904\",\"managedBy\":\"user\",\"name\":\"Quoting App\",\"operationalStatus\":\"Mended\",\"ownedBy\":\"ownerr\",\"status\":\"Installed\",\"supportGroup\":\"SME Operations\",\"supportedBy\":\"sopporter\",\"usedFor\":\"Production\"}]},\"businessInformation\":{\"company\":\"Qualys\",\"department\":\"Engineering\",\"environment\":\"QA\",\"managedBy\":\"Amit\",\"operationalStatus\":\"Blocked\",\"ownedBy\":\"Paul\",\"supportGroup\":\"ABC_01\",\"supportedBy\":\"Nick\"},\"cloudProvider\":{\"alibaba\":null,\"aws\":{\"ec2\":{\"accountId\":\"1234\",\"availabilityZone\":\"us-west-2a\",\"hasAgent\":true,\"hostname\":\"hostname_value\",\"imageId\":\"imageId_value\",\"instanceId\":\"instanceId_value\",\"instanceState\":\"RUNNING\",\"instanceType\":\"m4.large\",\"kernelId\":null,\"launchdate\":1653386892000,\"privateDNS\":\"privateDNS_value\",\"privateIpAddress\":\"10.0.0.1\",\"publicDNS\":null,\"publicIpAddress\":\"175.16.199.1\",\"qualysScanner\":false,\"region\":{\"code\":\"us-west-2\",\"name\":\"US West (Oregon)\"},\"spotInstance\":false,\"subnetId\":\"subnetId_value\",\"vpcId\":\"vpcId_value\"},\"tags\":[{\"key\":\"tags_key_1\",\"value\":\"tags_value_1\"},{\"key\":\"tags_key_2\",\"value\":\"tags_value_2\"}]},\"azure\":null,\"gcp\":null,\"ibm\":null,\"oci\":null},\"container\":{\"hasSensor\":\"temp_value\",\"noOfContainers\":5,\"noOfImages\":3,\"product\":\"mock_product\",\"version\":\"mock_version\"},\"cpuCount\":0,\"createdDate\":\"2025-07-09T14:21:12.000Z\",\"criticality\":{\"isDefault\":false,\"lastUpdated\":\"2025-07-09T14:21:11.000Z\",\"score\":3},\"customAttributes\":[{\"connectorName\":\"Qualys\",\"key\":\"Media State4\",\"value\":\"Media disconnected\"}],\"dnsName\":\"test_dns\",\"domain\":[\"domain1\",\"domain2\"],\"domainRole\":\"Member Workstation\",\"easmTags\":[\"cloud\",\"cdn\"],\"hardware\":{\"category\":\"Mock category 1 / Mock category 2\",\"category1\":\"Mock category 1\",\"category2\":\"Mock category 2\",\"fullName\":\"Mock hardware\",\"lifecycle\":{\"eosDate\":\"2025-07-09T14:21:12.000Z\",\"gaDate\":\"2025-07-09T14:21:12.000Z\",\"introDate\":\"2025-07-09T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"obsoleteDate\":\"2025-07-09T14:21:12.000Z\",\"stage\":\"Not Applicable\"},\"manufacturer\":\"Mock manufacturer\",\"model\":\"Mock model\",\"productFamily\":\"Mock product family\",\"productName\":\"Mock product name\",\"productUrl\":\"https://mock_product_url.com\",\"taxonomy\":{\"category1\":\"Mock category 1\",\"category2\":\"Mock category 2\",\"id\":\"mock_hardware_taxonomy_id\",\"name\":\"Mock hardware taxonomy name\"}},\"hostId\":1437386,\"hostingCategory1\":\"CDN\",\"hwUUID\":\"422a2b16-4c8b-588a-a20c-c1851ad7e376\",\"inventory\":{\"created\":1752070872000,\"lastUpdated\":1752243670000,\"source\":\"EASM\"},\"inventory_list_data\":{\"inventory\":[{\"created\":\"2024-01-12T03:40:12.000Z\",\"last_updated\":\"2025-11-04T08:08:04.000Z\",\"source\":\"EASM\"}]},\"isContainerHost\":false,\"isp\":\"test, Inc.\",\"lastBoot\":\"2025-07-09T14:21:12.000Z\",\"lastLocation\":{\"city\":\"New York\",\"continent\":\"North America\",\"country\":\"United States\",\"name\":\"United States\",\"postal\":\"94040\",\"state\":\"California\"},\"lastLoggedOnUser\":\"test_user\",\"lastModifiedDate\":\"2025-07-11T14:21:10.000Z\",\"lparId\":\"mock_lpar_id\",\"missingSoftware\":[\"test1\",\"test2\",\"test3\"],\"netbiosName\":\"test_bios\",\"networkInterfaceListData\":{\"networkInterface\":[{\"addressIpV4\":\"81.2.69.142\",\"addressIpV6\":\"::ffff:5102:458e\",\"addresses\":\"mock_Address\",\"dnsAddress\":\"mock_dns_address\",\"gatewayAddress\":\"mock_geteaway_address\",\"hostname\":\"mock_hostname\",\"interfaceName\":\"mock_interface_name\",\"macAddress\":\"00:0c:29:15:6a:72\",\"macVendorIntroDate\":946944000000,\"manufacturer\":\"Mock manufacturer\",\"netmask\":\"mock_net_mask\"}]},\"openPortListData\":{\"openPort\":[{\"authorization\":\"Mock authorization\",\"description\":\"http protocol over TLS/SSL\",\"detectedService\":\"HTTPs\",\"detectionScore\":100,\"discoverySources\":\"EASM\",\"firstFound\":\"2025-07-09T14:21:12.000Z\",\"lastUpdated\":\"2025-07-09T14:21:12.000Z\",\"port\":443,\"protocol\":\"TCP\"}]},\"operatingSystem\":{\"architecture\":\"x86\",\"category\":\"Operating System / Windows\",\"category1\":\"Windows\",\"category2\":\"Windows\",\"cpe\":\"mock_cpe\",\"cpeId\":\"mock_cpe_id\",\"cpeType\":\"Mock cpe type\",\"edition\":\"Enterprise\",\"fullName\":\"Microsoft Windows 10 Enterprise\",\"installDate\":\"2025-07-09T14:21:12.000Z\",\"lifecycle\":{\"detectionScore\":100,\"eolDate\":\"2025-07-09T14:21:12.000Z\",\"eolSupportStage\":\"End-of-life\",\"eosDate\":\"2025-07-09T14:21:12.000Z\",\"eosSupportStage\":\"End-of-life\",\"gaDate\":\"2025-07-09T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"stage\":\"End-of-life\"},\"marketVersion\":\"10.0.19042.1052\",\"osName\":\"Windows 10\",\"productFamily\":\"Mock product family\",\"productName\":\"Microsoft Windows 10 Enterprise\",\"productUrl\":\"https://mock_product_url.com\",\"publisher\":\"test\",\"release\":\"Mock release\",\"taxonomy\":{\"category1\":\"Mock category1\",\"category2\":\"Mock category2\",\"id\":\"mock_taxonomy_id\",\"name\":\"Mock taxonomy name\"},\"update\":\"22.04 LTS 22.04.5 LTS\",\"version\":\"10.0.19042.1052\"},\"organizationName\":[\"mock\"],\"processor\":{\"coresPerSocket\":2,\"description\":\"Intel(R) Xeon(R) Gold 6430\",\"multithreadingStatus\":\"test\",\"noOfSocket\":2,\"numCPUs\":4,\"speed\":3200,\"threadsPerCore\":2},\"provider\":\"AWS\",\"riskScore\":0,\"sensor\":{\"activatedForModules\":[\"mock_activated_module\"],\"firstEasmScanDate\":1752243670000,\"lastComplianceScan\":0,\"lastEasmScanDate\":1752243670000,\"lastFullScan\":0,\"lastPcScanDateAgent\":0,\"lastPcScanDateScanner\":0,\"lastVMScan\":0,\"lastVmScanDateAgent\":0,\"lastVmScanDateScanner\":0,\"pendingActivationForModules\":[\"mock_pending_module\"]},\"sensorLastUpdatedDate\":\"2025-07-11T14:21:10.000Z\",\"serviceList\":{\"service\":[{\"description\":\"temp_Decp\",\"name\":\"systemd-networkd.service\",\"status\":\"loaded/active/running\"}]},\"softwareComponent\":\"Apache HTTP Server\",\"softwareListData\":{\"software\":[{\"architecture\":\"x86_64\",\"authorization\":\"Mock authorization\",\"authorizationDetectionScore\":5,\"category\":\"Network Application / Web Servers\",\"category1\":\"Network Application\",\"category2\":\"Web Servers\",\"component\":\"Server\",\"cpe\":\"mock_cpe\",\"cpeId\":\"mock_cpe_id\",\"cpeType\":\"Mock cpe type\",\"discoveredName\":\"Mock discovered name\",\"discoveredPublisher\":\"Mock discovered publisher\",\"discoveredVersion\":\"mock_version\",\"discoverySources\":\"EASM\",\"edition\":\"Unknown\",\"formerlyKnownAs\":\"httpd\",\"fullName\":\"Apache HTTP Server\",\"id\":8464359598295418000,\"ignoredReason\":\"Insufficient Information\",\"installDate\":\"2021-10-25T14:21:12.000Z\",\"installPath\":\"/usr/local/apache2\",\"isIgnored\":false,\"isPackage\":false,\"isPackageComponent\":false,\"language\":\"C\",\"lastUpdated\":\"2021-10-25T14:21:12.000Z\",\"lastUseDate\":\"2021-10-25T14:21:12.000Z\",\"license\":{\"category\":\"Mock license category\",\"subcategory\":\"Mock license subcategory\"},\"lifecycle\":{\"detectionScore\":0,\"eolDate\":\"2021-10-25T14:21:12.000Z\",\"eolSupportStage\":\"Mock eol support stage\",\"eosDate\":\"2021-10-25T14:21:12.000Z\",\"eosSupportStage\":\"Mock eos support stage\",\"gaDate\":\"2021-10-25T14:21:12.000Z\",\"lifeCycleConfidence\":\"Exact\",\"stage\":\"Not Applicable\"},\"marketVersion\":\"Unknown\",\"packageName\":null,\"productName\":\"Apache HTTP Server\",\"productUrl\":\"https://en.wikipedia.org/wiki/Apache_HTTP_Server,,\",\"publisher\":\"Apache\",\"softwareInstances\":[{\"BIN_PATH\":\"/usr/bin/docker -H unix:///var/run/docker.sock\",\"CONF_PATH\":\"/etc/docker/daemon.json\",\"InstanceName\":\"DOCKER\",\"PROC\":\" 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock\",\"PRODUCT\":\"Docker\",\"TECHNOLOGY\":\"Docker CE_EE\",\"VERSION\":\"24.0.7\",\"firstSeen\":\"2025-07-08T01:15:52.000Z\",\"lastSeen\":\"2025-07-14T19:20:15.000Z\"}],\"softwareType\":\"Application\",\"supportStageDesc\":\"Mock support stage desc\",\"update\":\"2021-10-25\",\"version\":\"2.4.7\"}]},\"subdomain\":[\"subdomain1\",\"subdomain2\"],\"tagList\":{\"tag\":[{\"backgroundColor\":0,\"businessImpact\":\"mock_business_impact\",\"criticalityScore\":3,\"foregroundColor\":0,\"tagId\":25971788,\"tagName\":\"Shodan\"}]},\"timeZone\":\"+05:30\",\"totalMemory\":10,\"userAccountListData\":{\"userAccount\":[{\"name\":\"root\"},{\"name\":\"serviceuser\"},{\"name\":\"devuser\"}]},\"volumeListData\":{\"volume\":[{\"free\":34645118976,\"name\":\"/\",\"size\":48202350592}]},\"whois\":[{\"createdDate\":\"2024-02-23T00:00:00.000Z\",\"dnssec\":\"test\",\"domain\":\"test_domainr\",\"domainStatus\":\"clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited\",\"expirationDate\":\"2026-02-23T00:00:00.000Z\",\"registrantContact\":\"temp\",\"registrantCountry\":\"UNITED STATES\",\"registrantEmail\":\"594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com\",\"registrantName\":\"1API GmbH\",\"registrantOrganization\":\"Domains By Proxy, LLC\",\"registrar\":\"1API GmbH\",\"updatedDate\":\"2025-07-13T00:00:00.000Z\"}]}", + "module": "qualys_gav", "risk_score": 0, "timezone": "+05:30", "type": [ @@ -149,38 +162,23 @@ An example event for `asset` looks as following: "input": { "type": "cel" }, + "labels": { + "is_transform_source": "true" + }, "observer": { "product": "Global AssetView", "vendor": "Qualys" }, "package": { - "architecture": [ - "x86_64" - ], - "description": [ - "Mock support stage desc" - ], - "installed": [ - "2021-10-25T14:21:12.000Z" - ], - "license": [ - "Mock license category" - ], - "name": [ - "Apache HTTP Server" - ], - "path": [ - "/usr/local/apache2" - ], - "reference": [ - "https://en.wikipedia.org/wiki/Apache_HTTP_Server,," - ], - "type": [ - "Application" - ], - "version": [ - "2.4.7" - ] + "architecture": "x86_64", + "description": "Mock support stage desc", + "installed": "2021-10-25T14:21:12.000Z", + "license": "Mock license category", + "name": "Apache HTTP Server", + "path": "/usr/local/apache2", + "reference": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", + "type": "Application", + "version": "2.4.7" }, "qualys_gav": { "asset": { @@ -190,12 +188,10 @@ An example event for `asset` looks as following: }, "address": "216.160.83.56", "agent": { - "activations": [ - { - "key": "httpd", - "status": "ACTIVE" - } - ], + "activations": { + "key": "httpd", + "status": "ACTIVE" + }, "configuration_profile": "Apache HTTP Server", "connected_from": "216.160.83.56", "error_status": false, @@ -221,21 +217,19 @@ An example event for `asset` looks as following: "bios_description": "Test", "bios_serial_number": "Test serial number", "business_app_list_data": { - "business_app": [ - { - "business_criticality": "2 - Less Critical", - "environment": "Production", - "id": "BARCODE283904", - "managed_by": "user", - "name": "Quoting App", - "operational_status": "Mended", - "owned_by": "ownerr", - "status": "Installed", - "support_group": "SME Operations", - "supported_by": "sopporter", - "used_for": "Production" - } - ] + "business_app": { + "business_criticality": "2 - Less Critical", + "environment": "Production", + "id": "BARCODE283904", + "managed_by": "user", + "name": "Quoting App", + "operational_status": "Mended", + "owned_by": "ownerr", + "status": "Installed", + "support_group": "SME Operations", + "supported_by": "sopporter", + "used_for": "Production" + } }, "business_information": { "company": "Qualys", @@ -271,16 +265,16 @@ An example event for `asset` looks as following: "subnet_id": "subnetId_value", "vpc_id": "vpcId_value" }, - "tags": [ - { - "key": "tags_key_1", - "value": "tags_value_1" - }, - { - "key": "tags_key_2", - "value": "tags_value_2" - } - ] + "tags": { + "key": [ + "tags_key_1", + "tags_key_2" + ], + "value": [ + "tags_value_1", + "tags_value_2" + ] + } } }, "container": { @@ -297,13 +291,11 @@ An example event for `asset` looks as following: "last_updated": "2025-07-09T14:21:11.000Z", "score": 3 }, - "custom_attributes": [ - { - "connector_name": "Qualys", - "key": "Media State4", - "value": "Media disconnected" - } - ], + "custom_attributes": { + "connector_name": "Qualys", + "key": "Media State4", + "value": "Media disconnected" + }, "dns_name": "test_dns", "domain": [ "domain1", @@ -342,21 +334,19 @@ An example event for `asset` looks as following: "host_id": "1437386", "hosting_category1": "CDN", "hw_uuid": "422a2b16-4c8b-588a-a20c-c1851ad7e376", - "interval_id": "da729d8d-7a83-44c4-b528-58e6712bff6e", - "interval_start": "2026-02-04T06:51:04.300Z", + "interval_id": "425283cc-3c3d-4629-a7d1-bdf5d1c0a6eb", + "interval_start": "2026-07-09T16:29:57.964Z", "inventory": { "created": "2025-07-09T14:21:12.000Z", "last_updated": "2025-07-11T14:21:10.000Z", "source": "EASM" }, "inventory_list_data": { - "inventory": [ - { - "created": "2024-01-12T03:40:12.000Z", - "last_updated": "2025-11-04T08:08:04.000Z", - "source": "EASM" - } - ] + "inventory": { + "created": "2024-01-12T03:40:12.000Z", + "last_updated": "2025-11-04T08:08:04.000Z", + "source": "EASM" + } }, "is_container_host": false, "isp": "test, Inc.", @@ -379,40 +369,32 @@ An example event for `asset` looks as following: ], "netbios_name": "test_bios", "network_interface_list_data": { - "network_interface": [ - { - "address_ip_v4": [ - "81.2.69.142" - ], - "address_ip_v6": [ - "::ffff:5102:458e" - ], - "addresses": "mock_Address", - "dns_address": "mock_dns_address", - "gateway_address": "mock_geteaway_address", - "hostname": "mock_hostname", - "interface_name": "mock_interface_name", - "mac_address": "00-0C-29-15-6A-72", - "mac_vendor_intro_date": "2000-01-04T00:00:00.000Z", - "manufacturer": "Mock manufacturer", - "netmask": "mock_net_mask" - } - ] + "network_interface": { + "address_ip_v4": "81.2.69.142", + "address_ip_v6": "81.2.69.142", + "addresses": "mock_Address", + "dns_address": "mock_dns_address", + "gateway_address": "mock_geteaway_address", + "hostname": "mock_hostname", + "interface_name": "mock_interface_name", + "mac_address": "00-0C-29-15-6A-72", + "mac_vendor_intro_date": "2000-01-04T00:00:00.000Z", + "manufacturer": "Mock manufacturer", + "netmask": "mock_net_mask" + } }, "open_port_list_data": { - "open_port": [ - { - "authorization": "Mock authorization", - "description": "http protocol over TLS/SSL", - "detected_service": "HTTPs", - "detection_score": 100, - "discovery_sources": "EASM", - "first_found": "2025-07-09T14:21:12.000Z", - "last_updated": "2025-07-09T14:21:12.000Z", - "port": 443, - "protocol": "TCP" - } - ] + "open_port": { + "authorization": "Mock authorization", + "description": "http protocol over TLS/SSL", + "detected_service": "HTTPs", + "detection_score": 100, + "discovery_sources": "EASM", + "first_found": "2025-07-09T14:21:12.000Z", + "last_updated": "2025-07-09T14:21:12.000Z", + "port": 443, + "protocol": "TCP" + } }, "operating_system": { "architecture": "x86", @@ -451,9 +433,7 @@ An example event for `asset` looks as following: "update": "22.04 LTS 22.04.5 LTS", "version": "10.0.19042.1052" }, - "organization_name": [ - "mock" - ], + "organization_name": "mock", "processor": { "cores_per_socket": 2, "description": "Intel(R) Xeon(R) Gold 6430", @@ -466,109 +446,97 @@ An example event for `asset` looks as following: "provider": "AWS", "risk_score": 0, "sensor": { - "activated_for_modules": [ - "mock_activated_module" - ], + "activated_for_modules": "mock_activated_module", "first_easm_scan_date": "2025-07-11T14:21:10.000Z", "last_easm_scan_date": "2025-07-11T14:21:10.000Z", - "pending_activation_for_modules": [ - "mock_pending_module" - ] + "pending_activation_for_modules": "mock_pending_module" }, "sensor_last_updated_date": "2025-07-11T14:21:10.000Z", "service_list": { - "service": [ - { - "description": "temp_Decp", - "name": "systemd-networkd.service", - "status": "loaded/active/running" - } - ] + "service": { + "description": "temp_Decp", + "name": "systemd-networkd.service", + "status": "loaded/active/running" + } }, "software_component": "Apache HTTP Server", "software_list_data": { - "software": [ - { - "architecture": "x86_64", - "authorization": "Mock authorization", - "authorization_detection_score": 5, - "category": "Network Application / Web Servers", - "category1": "Network Application", - "category2": "Web Servers", - "component": "Server", - "cpe": "mock_cpe", - "cpe_id": "mock_cpe_id", - "cpe_type": "Mock cpe type", - "discovered_name": "Mock discovered name", - "discovered_publisher": "Mock discovered publisher", - "discovered_version": "mock_version", - "discovery_sources": "EASM", - "edition": "Unknown", - "formerly_known_as": "httpd", - "full_name": "Apache HTTP Server", - "id": "8464359598295418000", - "ignored_reason": "Insufficient Information", - "install_date": "2021-10-25T14:21:12.000Z", - "install_path": "/usr/local/apache2", - "is_ignored": false, - "is_package": false, - "is_package_component": false, - "language": "C", - "last_updated": "2021-10-25T14:21:12.000Z", - "last_use_date": "2021-10-25T14:21:12.000Z", - "license": { - "category": "Mock license category", - "subcategory": "Mock license subcategory" - }, - "lifecycle": { - "detection_score": 0, - "eol_date": "2021-10-25T14:21:12.000Z", - "eol_support_stage": "Mock eol support stage", - "eos_date": "2021-10-25T14:21:12.000Z", - "eos_support_stage": "Mock eos support stage", - "ga_date": "2021-10-25T14:21:12.000Z", - "life_cycle_confidence": "Exact", - "stage": "Not Applicable" - }, - "market_version": "Unknown", - "product_name": "Apache HTTP Server", - "product_url": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", - "publisher": "Apache", - "software_instances": [ - { - "bin_path": "/usr/bin/docker -H unix:///var/run/docker.sock", - "conf_path": "/etc/docker/daemon.json", - "first_seen": "2025-07-08T01:15:52.000Z", - "instance_name": "DOCKER", - "last_seen": "2025-07-14T19:20:15.000Z", - "proc": " 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock", - "product": "Docker", - "technology": "Docker CE_EE", - "version": "24.0.7" - } - ], - "software_type": "Application", - "support_stage_desc": "Mock support stage desc", - "update": "2021-10-25", - "version": "2.4.7" - } - ] + "software": { + "architecture": "x86_64", + "authorization": "Mock authorization", + "authorization_detection_score": 5, + "category": "Network Application / Web Servers", + "category1": "Network Application", + "category2": "Web Servers", + "component": "Server", + "cpe": "mock_cpe", + "cpe_id": "mock_cpe_id", + "cpe_type": "Mock cpe type", + "discovered_name": "Mock discovered name", + "discovered_publisher": "Mock discovered publisher", + "discovered_version": "mock_version", + "discovery_sources": "EASM", + "edition": "Unknown", + "formerly_known_as": "httpd", + "full_name": "Apache HTTP Server", + "id": "8464359598295418000", + "ignored_reason": "Insufficient Information", + "install_date": "2021-10-25T14:21:12.000Z", + "install_path": "/usr/local/apache2", + "is_ignored": false, + "is_package": false, + "is_package_component": false, + "language": "C", + "last_updated": "2021-10-25T14:21:12.000Z", + "last_use_date": "2021-10-25T14:21:12.000Z", + "license": { + "category": "Mock license category", + "subcategory": "Mock license subcategory" + }, + "lifecycle": { + "detection_score": 0, + "eol_date": "2021-10-25T14:21:12.000Z", + "eol_support_stage": "Mock eol support stage", + "eos_date": "2021-10-25T14:21:12.000Z", + "eos_support_stage": "Mock eos support stage", + "ga_date": "2021-10-25T14:21:12.000Z", + "life_cycle_confidence": "Exact", + "stage": "Not Applicable" + }, + "market_version": "Unknown", + "product_name": "Apache HTTP Server", + "product_url": "https://en.wikipedia.org/wiki/Apache_HTTP_Server,,", + "publisher": "Apache", + "software_instances": { + "bin_path": "/usr/bin/docker -H unix:///var/run/docker.sock", + "conf_path": "/etc/docker/daemon.json", + "first_seen": "2025-07-08T01:15:52.000Z", + "instance_name": "DOCKER", + "last_seen": "2025-07-14T19:20:15.000Z", + "proc": " 1487 1 root /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock", + "product": "Docker", + "technology": "Docker CE_EE", + "version": "24.0.7" + }, + "software_type": "Application", + "support_stage_desc": "Mock support stage desc", + "update": "2021-10-25", + "version": "2.4.7" + } }, "subdomain": [ "subdomain1", "subdomain2" ], "tag_list": { - "tag": [ - { - "background_color": "0", - "business_impact": "mock_business_impact", - "criticality_score": 3, - "foreground_color": "0", - "tag_id": "25971788", - "tag_name": "Shodan" - } - ] + "tag": { + "background_color": "0", + "business_impact": "mock_business_impact", + "criticality_score": 3, + "foreground_color": "0", + "tag_id": "25971788", + "tag_name": "Shodan" + } }, "time_zone": "+05:30", "total_memory": 10, @@ -586,30 +554,26 @@ An example event for `asset` looks as following: ] }, "volume_list_data": { - "volume": [ - { - "free": 34645118976, - "name": "/", - "size": 48202350592 - } - ] - }, - "whois": [ - { - "created_date": "2024-02-23T00:00:00.000Z", - "dnssec": "test", - "domain": "test_domainr", - "domain_status": "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited", - "expiration_date": "2026-02-23T00:00:00.000Z", - "registrant_contact": "REDACTED", - "registrant_country": "UNITED STATES", - "registrant_email": "594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com", - "registrant_name": "1API GmbH", - "registrant_organization": "Domains By Proxy, LLC", - "registrar": "1API GmbH", - "updated_date": "2025-07-13T00:00:00.000Z" + "volume": { + "free": 34645118976, + "name": "/", + "size": 48202350592 } - ] + }, + "whois": { + "created_date": "2024-02-23T00:00:00.000Z", + "dnssec": "test", + "domain": "test_domainr", + "domain_status": "clientDeleteProhibited clientRenewProhibited clientTransferProhibited clientUpdateProhibited", + "expiration_date": "2026-02-23T00:00:00.000Z", + "registrant_contact": "REDACTED", + "registrant_country": "UNITED STATES", + "registrant_email": "594f93785ec9444aa7ebabd79b665059@domainsbyproxy.com", + "registrant_name": "1API GmbH", + "registrant_organization": "Domains By Proxy, LLC", + "registrar": "1API GmbH", + "updated_date": "2025-07-13T00:00:00.000Z" + } } }, "related": { @@ -630,7 +594,7 @@ An example event for `asset` looks as following: "ip": [ "216.160.83.56", "81.2.69.142", - "::ffff:5102:458e" + "81.2.69.142" ], "user": [ "test_user" diff --git a/packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml b/packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml index 24e9e926793..8deb67e426a 100644 --- a/packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml +++ b/packages/qualys_gav/elasticsearch/transform/latest_asset/manifest.yml @@ -1,5 +1,8 @@ start: true destination_index_template: + settings: + index: + mode: lookup mappings: dynamic: true dynamic_templates: diff --git a/packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml b/packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml index b364e4ad4f1..f5038e5d621 100644 --- a/packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml +++ b/packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml @@ -33,5 +33,5 @@ _meta: managed: false # Bump this version to delete, reinstall, and restart the transform during # package installation. - fleet_transform_version: 0.2.0 + fleet_transform_version: 0.3.0 run_as_kibana_system: false diff --git a/packages/qualys_gav/manifest.yml b/packages/qualys_gav/manifest.yml index 452cd178fd7..237101b8f9f 100644 --- a/packages/qualys_gav/manifest.yml +++ b/packages/qualys_gav/manifest.yml @@ -1,7 +1,7 @@ -format_version: 3.3.2 +format_version: 3.4.0 name: qualys_gav title: Qualys Global AssetView -version: 0.8.0 +version: 0.9.0 description: Collect logs from Qualys Global AssetView with Elastic Agent. type: integration categories: