Configure Zero-touch API Based Scan

1. Login to AWS Console and navigate to AWS Systems Manager.

2. Click Inventory > Setup Inventory.

3. Keep the default settings and click Setup Inventory.

The region presently active in the AWS account will be selected as the region where all managed instances are fetched. 

 

1. Login to AWS console and navigate to AWS Systems Manager.

2. Click Quick Setup > Create.

 

 

3. In Host management > Click Create.

 

4. Go to 'Configuration options'.

5. Under Systems manager, select 'Collect inventory from your instances every 30 minutes'.

6. Under Targets, you can either choose between deploying to the current Region or a custom set of regions.

7. Choose regions.

8. Choose how you want to target instances. Let's select 'All instances'.

 

9. Next, under Target Regions.

10. Select 'All Regions'.

11. Click Create.

Follow the below steps to enable your cloud events to reach the Qualys platform.

 

API Destination Connection

curl --location --request POST 'https://< API Gateway URL >/auth' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'username=<QualysUsername> --data-urlencode 'password=<QualysPassword>'--data-urlencode 'token=true'

1. Login to AWS Console and navigate to Amazon EventBridge.
2. Click Integrations > API destinations > Connections tabs > Create Connection.

3. Next, enter the connection name and Description.

4. Under 'Authorization', select Destination type as 'Others'.
5. Selection Authorization type as 'API Key'.
6. Enter API Key name and Value.
7. Under 'Invocation Http Parameters', provide the parameter, key and value.
8. Steps to generate a Subscription Token.
9. Generate Auth token.

     10. Generate Subscription Token.

curl --location --request POST 'https://< API Gateway URL >/qas/subscription-token' --header 'Content-Type: application/json' --header 'Authorization: Bearer <Auth Token> --data-raw '{ "expiry": 500000}'

       11. Click Create.

Now that the connection to the destination has been authorized, we must provide the Qualys API endpoint as the destination to establish the EventBridge connection.

 

API Destination

1. Click Integrations -> API destinations -> API destinations tabs -> Create API Destination
2. API Destination details.
3. Enter Name and Description.
4. Enter the API destination URL: <qualys_platform_url>/qflow/aws-eb, 
5. Select HTTP Method as POST.
6. Select Connection as 'Use an existing connection'.
7. Select the API Destination Connection created above.
   
   

 

Now, we configure the Rules so that EventBridge knows what to listen to before passing the information to Qualys. In this case, we set the Rule to listen to changes in Instance states. Specifically, the event is alerted when instances are switched to running states.

 

Rules

1. Click Events -> Rules -> Create Rule 
2. Rule details.
3. Enter Name and Description.
4. Select Event bus as 'Default'.
5. Select Rule Type as 'Rule with an event pattern'.
6. Click Next.
   
   
7. Event pattern.
8. Select Event Source as AWS Services.
9. Select AWS service as EC2.
10. Select Event type as 'EC2 Instance State-change Notification'.
11. Select Specific state(s) as running.
12. Click Next.
    
    
13. Select targets 
14. Select Target types as 'EventBridge API destination'.
15. Select API destination as 'Use an existing API destination' (Select the API destination which was created as part of the API Destination).
16. Select Execution role as 'Create a new role for this specific resource'.
17. Click Next.
    
    
18. Under Tags, configure tags if required.
19. Click Next.
20. Click Review and create.
21. Click Create Rule.

 

 

1. Login to AWS Console and navigate to CloudFormation. 
2. Stack > Create Stack > With new resources (standard).
3. In 'Specify template', upload the template file.
4. Click Next.
5. Under Specify stack details, provide Stack name.
6. In APIGatewayURL parameter, provide the Qualys API Gateway URL. Find the Gateway URL at https://www.qualys.com/platform-identification/ 
7. Provide the SubscriptionToken and click next.
8. Keep the default settings step 3 and step 4.
9. Click Next > Submit.