Qualys Event Collector #26989

daryakoval · 2023-05-24T18:25:53Z

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: https://jira-hq.paloaltonetworks.local/browse/CIAC-4957

Description

New Integration - Qualys Event Collector

Must have

Tests
Documentation

dantavori

looks good 👍🏽 see my notes
we recently faced situations (in other collectors) where there have been significantly more events between each interval than the max_fetch, which caused events to arrive very late. let's ensure this is not the case in this collector (consult with a TPM or with me if needed).

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md

Packs/qualys/Integrations/QualysEventCollector/README.md

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.py

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

dantavori

very nice, see my few small notes :)

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md

Packs/qualys/ReleaseNotes/1_3_0.md

Packs/qualys/pack_metadata.json

Packs/qualys/ModelingRules/QualysModelingRules/QualysModelingRules.yml

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.py

dantavori · 2023-07-06T10:21:08Z

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.py

+
+    events, new_next_run = fetch_function(client, time_to_fetch, max_fetch, next_page)
+
+    updated_next_run = {previous_run_time_field: new_next_run.get(previous_run_time_field)}


isn't it equivalent to:

Suggested change

updated_next_run = {previous_run_time_field: new_next_run.get(previous_run_time_field)}

updated_next_run = {previous_run_time_field: time_to_fetch}

also, why not just use new_next_run instead of updated_next_run? it's a bit confusing to follow

because it is not really new, it may be old but updated.

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.yml

Packs/qualys/Integrations/QualysEventCollector/README.md

ShirleyDenkberg · 2023-07-06T16:23:23Z

@dantavori Doc review completed.

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

dantavori

let's wait for Meital's answer about the category, except for that - see my last documentation notes and we are good to go. great job!

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.py

Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.yml

…ector.yml Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

* save template to start * still starting * save * save the actions logs fetch * save start modeling rules * save design fixes * save code changes * adding modeling rules * save modeling rules * save unit tests * mistske dding from master * saving last changes * Apply suggestions from code review Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> * saving todo that missed * fixes from cr * generate readme * save more logs * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * save release notes * save docker image * improved documentation * removed demisto from readme * save fix validations * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector_description.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * fix unit tests * handle last run missmatch in host detections * Bump pack from version qualys to 1.3.0. * save * fix validation * re-implementing all the fetch mechanizm * save unit tests * fix flake8 * add new parameters to readme * fix pre-commit * Apply suggestions from code review Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/qualys/ReleaseNotes/1_3_0.md Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> * Update Packs/qualys/ReleaseNotes/1_3_0.md Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * fixes from the cr * fixes that broke unitests from the cr * more changes from the cr * fixes for fetch * save pre-commit fixes * Update Packs/qualys/Integrations/QualysEventCollector/QualysEventCollector.yml Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> * last changes from the pr * save comments --------- Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com>

Darya Koval added 19 commits April 23, 2023 16:28

save template to start

50e5955

still starting

64bbab0

save

15d8466

Merge branch 'master' into qualys-event-collector

325c2fa

save the actions logs fetch

6a98c98

save start modeling rules

b559244

save design fixes

0ea1fb6

save code changes

2e03806

Merge branch 'master' into qualys-event-collector

28af2de

adding modeling rules

fb18d83

Merge branch 'master' into qualys-event-collector

19dc8a3

save modeling rules

9214c4e

Merge branch 'master' into qualys-event-collector

c5acb38

Merge branch 'master' into qualys-event-collector

6b59e51

save unit tests

cadb64a

Merge branch 'master' into qualys-event-collector

d2cafbc

mistske dding from master

6661240

saving last changes

684b7fa

Merge branch 'master' into qualys-event-collector

472e5b4

daryakoval marked this pull request as ready for review May 28, 2023 13:27

daryakoval requested a review from dantavori May 28, 2023 13:27

dantavori requested changes May 30, 2023

View reviewed changes

daryakoval and others added 7 commits May 31, 2023 11:55

Apply suggestions from code review

baf59d5

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

saving todo that missed

2959a43

fixes from cr

510f640

fixes from cr pulled from master

890d519

generate readme

b3f6a8c

Merge branch 'master' into qualys-event-collector

9d8790d

save more logs

54dd836

daryakoval assigned ShirleyDenkberg Jun 11, 2023

daryakoval added 2 commits June 29, 2023 18:34

add new parameters to readme

f9edc74

fix pre-commit

01e6eea

dantavori requested changes Jul 6, 2023

View reviewed changes

ShirleyDenkberg reviewed Jul 6, 2023

View reviewed changes

daryakoval and others added 12 commits July 10, 2023 10:51

Apply suggestions from code review

b536a1a

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/qualys/ReleaseNotes/1_3_0.md

e1d18c6

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

Update Packs/qualys/ReleaseNotes/1_3_0.md

a2676c2

Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

Apply suggestions from code review

68774d9

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Merge branch 'master' into qualys-event-collector

24b8cc3

fixes from the cr

b46eb42

fixes that broke unitests from the cr

f96fe1d

more changes from the cr

0643617

Merge branch 'master' into qualys-event-collector

5f09b41

fixes for fetch

40a46ac

save pre-commit fixes

30fdcfd

Merge branch 'master' into qualys-event-collector

13f91f1

daryakoval requested a review from dantavori July 11, 2023 09:49

dantavori approved these changes Jul 11, 2023

View reviewed changes

daryakoval and others added 7 commits July 12, 2023 12:50

Update Packs/qualys/Integrations/QualysEventCollector/QualysEventColl…

94af4a2

…ector.yml Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

last changes from the pr

e935949

merge from master

ff7eef7

Merge branch 'master' into qualys-event-collector

bde9eae

save comments

a3a6c13

Merge branch 'master' into qualys-event-collector

4704900

Merge branch 'master' into qualys-event-collector

e166cf1

daryakoval merged commit 7bd6e27 into master Jul 12, 2023
13 of 14 checks passed

daryakoval deleted the qualys-event-collector branch July 12, 2023 20:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Qualys Event Collector #26989

Qualys Event Collector #26989

daryakoval commented May 24, 2023

dantavori left a comment

dantavori left a comment

dantavori Jul 6, 2023

dantavori Jul 6, 2023

daryakoval Jul 10, 2023

ShirleyDenkberg commented Jul 6, 2023

dantavori left a comment


		events, new_next_run = fetch_function(client, time_to_fetch, max_fetch, next_page)

		updated_next_run = {previous_run_time_field: new_next_run.get(previous_run_time_field)}

Qualys Event Collector #26989

Qualys Event Collector #26989

Conversation

daryakoval commented May 24, 2023

Status

Related Issues

Description

Must have

dantavori left a comment

Choose a reason for hiding this comment

dantavori left a comment

Choose a reason for hiding this comment

dantavori Jul 6, 2023

Choose a reason for hiding this comment

dantavori Jul 6, 2023

Choose a reason for hiding this comment

daryakoval Jul 10, 2023

Choose a reason for hiding this comment

ShirleyDenkberg commented Jul 6, 2023

dantavori left a comment

Choose a reason for hiding this comment