Execute Scripts

You can execute a script only after it is approved. When you execute a script, CAR creates a new job and lists it under the Jobs tab.

For information about approving a script, see Reviewing and Approving Scripts.

You can test the script before executing it. For more information, see Testing Scripts.

If an asset job is pending, CAR does not create a new asset job for that asset when you execute the same script within 14 days of the previous execution.. For more information, refer to Optimization of Asset Job Handling in CAR.

Use Reboot to restart the host after script execution. You can specify when to restart the host. The delay must be at least 10 minutes and no more than 48 hours. Select the required duration from the drop-down list. Reboot applies only to Windows scripts.

The host is rebooted only when the CAR job status is Execution Passed.

To execute a script, follow these steps:

In the Scripts tab, select a script and then click Quick Actions menu, click Run Now.
Run Now is available only for approved scripts.

Policy Audit Fix Scripts can run only on PAF-enabled assets.
If you selected Perimeter Devices as the device type, specify the Network and Scanner Appliance that CAR uses to run the script:
1. Network: Select the network that contains your target devices.
2. Scanner Appliance: Select the Scanner Appliance that runs the script on the target devices. Configure the scanner appliance in VMDR before you run the script. For more details, refer to the Configure Scanner Appliance and Perimeter Devices.
  
  For Agent Devices, CAR does not display the Network and Scanner Appliance options because they are not required.
For both Agent Devices and Perimeter Devices, select the assets or asset tags to include in the script run.
In the Select Assets screen, define the scope of your script by selecting assets and/or by including asset tags. You can select any of the following options for asset selection while executing a script:
a. Manual Asset Selection:

Manually select the assets that you want to include in the script run.

When you execute a parameterized script, you can modify the Script Parameters value as required.
If you want to specify assets, below are the ways for asset selection:
1. Manual Asset Selection
2. Import Assets
3. Automated Assets Selection

In the Add Assets section of the Select Assets page, click the + sign.
In the Select Assets page, select the assets that you want to include in the script run and then click Apply.

If you want to include asset tags, follow these steps:

In the Add Asset Tag section of the Select Assets page, click the + sign.
In the Select Tags page, select the tags that you want to include in the script run and then click Apply.

You can add All or Any asset tags.

In the Exclude the Assets section, click the + sign.
In the Select Assets page, select the assets that you want to exclude and then click Apply. The Exclude host for the tags option is available only when you include asset tags. Use this option to exclude specific assets assigned to the selected tags.

b. Import Assets:

Upload a CSV file containing asset names and use those assets to execute a script and schedule it. It helps you quickly target multiple assets at a time.
Click Browse to upload the CSV file from your destination. Before execution, all imported assets are automatically validated to identify any errors or inconsistencies.
The feature supports both immediate execution and scheduled script execution workflows, providing flexibility in managing asset imports.
- CSV file should be in the comma-delimited format.
- CSV files are allowed up to 2 MB in size and support up to 5,000 assets per import.
- The CSV file must contain only unique asset names. Any duplicate asset names found in the CSV file are marked as invalid with the reason Duplicate asset. Ensure each asset name appears only once in the file before uploading.
The script runs on the assets listed in the uploaded CSV file. After uploading the CSV file, you can download a report that lists the assets that failed validation. Each entry includes the asset name and a validation message that explains why the asset was excluded.

The CSV file includes possible reasons for validation failures and their corresponding conditions:

Validation Message	Description
Not found	The asset name does not exist in your account.
Lab asset	The asset is a lab asset and is only available in test mode.
Blocked asset	The asset is in the global exclusion list and cannot be scheduled.
Platform is invalid	The asset's operating system does not match the script's platform.
This is not lab asset	In test mode, only lab assets are eligible for validation.
Duplicate asset	The same asset name appears more than once in the CSV file.

Limitations

Asset names must exist in the database to pass the validation.
Failed asset download information is available for a limited duration after validation.

C. Automated Assets Selection

Use the Automated Asset Selection option to identify and select assets for script execution using a QQL query. The QQL query allows you to filter assets based on the provided QQL criteria. This helps you quickly target the required assets while reducing manual selection effort.
Enter a valid QQL query in a Search field. You can Preview the results to view the assets that match the query.

Example: operatingSystem.name:windows

3. Select the following toggle switch as required:

Bypass PowerShell Execution Policy: Use this toggle to specify if you want to override the PowerShell execution policy on Windows agents. When you switch this toggle to Yes, both signed and unsigned scripts are executed on the agent irrespective of the PowerShell execution policy set on the asset.
This option is displayed only when you execute a Windows PowerShell script.
Reboot Host after Script Execution: If you turn this toggle to Yes and set a delay, the system waits for the selected duration after the script execution completes and then initiates the reboot process.
The Delay before Reboot option enables you to specify a time period before the system is rebooted following the execution of a script.
This ensures a smooth transition between the execution of the script and the reboot process, allowing you to manage system changes in a controlled and efficient manner.
Monitor this script’s output for any changes: Use this toggle to share the script output to monitor and detect any changes to the FIM assets and displays those changes as events in FIM.

The Reboot Host after Script Execution, Bypass PowerShell Execution Policy, and Monitor this script's output for any changes options apply only to agent devices.

4. Click Execute Script.

You cannot execute the same script within a span of 5 minutes.

You can view the status of the executed script under the Jobs tab.

Unlike the evaluated scripts, the name of the executed script is displayed as it is, without any suffix or prefix.

How Perimeter Devices Executes

Once you save the script creation flow for a perimeter device, CAR saves the script with the device type set to perimeter/non-agent. If you don't create the script in the approved state, it displays on the Scripts tab as Pending Test and must be approved before you can run it.

When you run or schedule the script with perimeter device type selection, the Qualys Scanner Appliance runs the script on the target devices as part of a scan job.
CAR creates one job for the execution. It then sends the device IP addresses to the scanner appliance in batches of up to 100, and each batch runs as a separate scan. CAR tracks each device with its own asset job.
CAR collects the script results.
You can view the status of the executed script under the Jobs tab. For Custom QID scripts, CAR reports detected issues as findings in VM/VMDR.

Limitations

Car Script execution does not support parent-child tag relationships. Only directly assigned tags are recognized by CAR.

Execute Scripts

a. Manual Asset Selection:

b. Import Assets:

Limitations

C. Automated Assets Selection

How Perimeter Devices Executes

Limitations

Related Topics