Qualys Vulnerability Trigger Scan Subworkflow

This n8n workflow acts as a subworkflow, designed to be triggered by another workflow. Its primary function is to initiate a Qualys vulnerability scan based on provided input data, handle the scan's asynchronous nature by waiting for completion, and then process the scan results. It also includes error handling and notification mechanisms via Slack.

What it does:

1. Receives Trigger: Listens for execution from another n8n workflow, expecting input data containing details for a Qualys scan.
2. Initial Scan Request: Makes an HTTP POST request to the Qualys API to launch a new vulnerability scan.
3. Extracts Scan Reference: Parses the XML response from Qualys to extract the scan reference (e.g., SCAN_REF) which is crucial for monitoring the scan status.
4. Monitors Scan Status: Enters a loop to periodically check the Qualys API for the status of the initiated scan.
   • It waits for a defined interval (e.g., 30 seconds) between checks.
   • It continues checking until the scan status is no longer "Running".
5. Processes Scan Results (if successful):
   • If the scan completes successfully, it makes another HTTP GET request to the Qualys API to retrieve the detailed scan results.
   • It extracts the scan report ID from the results.
   • It then makes a final HTTP GET request to download the actual scan report.
6. Handles Scan Failure: If the scan status is not "Running" and not "Finished", it assumes a failure and sends a Slack notification with the error details.
7. Notifies on Completion: Regardless of success or failure, it sends a Slack notification indicating the scan's final status and relevant details.

Prerequisites/Requirements:

• Qualys Account: Access to the Qualys API with appropriate permissions to initiate and retrieve scan data.
• Qualys API Credentials: Configured as an HTTP Request credential in n8n for authentication with the Qualys API.
• Slack Account: A Slack workspace and a configured Slack credential in n8n for sending notifications.
• Parent n8n Workflow: This workflow is designed to be called as a subworkflow. A parent workflow must be set up to trigger this workflow and provide the necessary input data (e.g., scan parameters).

Setup/Usage:

1. Import the workflow: Import the provided JSON into your n8n instance.
2. Configure Credentials:
   • Set up your Qualys API credentials for the "HTTP Request" nodes. This typically involves an API key or username/password authentication.
   • Set up your Slack credentials for the "Slack" nodes.
3. Review Node Configurations:
   • HTTP Request nodes: Ensure the Qualys API endpoints, headers, and body content are correctly configured for your Qualys environment and desired scan parameters.
   • Wait node: Adjust the wait time between status checks if needed.
   • Slack nodes: Customize the message content and target channel for notifications.
4. Integrate with a Parent Workflow:
   • In your parent workflow, use an "Execute Workflow" node (or similar) to call this subworkflow.
   • Pass the necessary data for the Qualys scan (e.g., target IP, scan profile, etc.) as input to this subworkflow.
5. Activate the workflow: Once configured, activate the workflow in n8n. It will then be ready to be triggered by other workflows.