n8n Workflow: Process Qualys Reports for TheHive

This n8n workflow is designed to automate the ingestion and processing of Qualys vulnerability reports, preparing them for analysis and incident response within TheHive. It fetches reports, parses their XML content, extracts relevant vulnerability data, and then creates alerts in TheHive for further investigation.

What it does

This workflow performs the following key steps:

1. Triggers on Schedule or Manually: The workflow can be initiated on a defined schedule (e.g., daily, weekly) or manually executed.
2. Fetches Qualys Reports: It makes an HTTP request to a Qualys API endpoint to retrieve vulnerability reports.
3. Parses XML Data: The raw XML response from Qualys is parsed into a structured JSON format.
4. Filters for Relevant Reports: It applies a filter to identify specific reports based on criteria (e.g., report name, status).
5. Prepares Report Data: The workflow processes the filtered reports, extracting key information like report ID, scan date, and host details.
6. Loops Through Report Items: For each identified report, it iterates through its contents to extract individual vulnerabilities or findings.
7. Transforms Data for TheHive: It maps the extracted Qualys data to the structure required for creating alerts in TheHive. This includes setting alert titles, descriptions, and observable data.
8. Executes Sub-workflow for TheHive Alert Creation: It calls a sub-workflow (likely responsible for TheHive integration) to create a new alert in TheHive for each processed report or significant finding.
9. Introduces a Delay: A Wait node is used to introduce a pause between actions, potentially to avoid hitting API rate limits or to allow systems to catch up.
10. Annotates Workflow Steps: Sticky notes are used to provide inline documentation and context for various parts of the workflow.

Prerequisites/Requirements

To use this workflow, you will need:

• Qualys Account: With API access enabled to fetch reports.
• TheHive Instance: A running instance of TheHive (version 5 or compatible) where alerts will be created.
• n8n TheHive 5 Credential: Configured in your n8n instance to authenticate with your TheHive API.
• n8n API Key: If the "Execute Workflow" node targets another n8n workflow that requires authentication.
• Sub-workflow for TheHive: A separate n8n workflow that handles the actual creation of alerts in TheHive, as indicated by the "Execute Sub-workflow" node. (This workflow calls such a sub-workflow, but does not contain its definition).

Setup/Usage

1. Import the workflow: Import the provided JSON into your n8n instance.
2. Configure Credentials:
   • Set up your Qualys API credentials for the "HTTP Request" node. This typically involves an API key or username/password for basic authentication.
   • Ensure your "TheHive 5" credential is correctly configured in n8n.
3. Configure "HTTP Request" node (ID: 19):
   • Update the URL to your Qualys API endpoint for fetching reports.
   • Adjust headers and authentication as per your Qualys API requirements.
4. Configure "Filter" node (ID: 844):
   • Modify the conditions to filter Qualys reports based on your specific needs (e.g., report template name, status, date range).
5. Configure "Edit Fields" (Set) node (ID: 38):
   • Adjust the data transformation logic to extract the exact fields you need from the Qualys XML for TheHive.
6. Configure "Loop Over Items" (Split in Batches) node (ID: 39):
   • Ensure it correctly iterates over the relevant items within your Qualys report data (e.g., individual hosts, vulnerabilities).
7. Configure "Execute Sub-workflow" node (ID: 111):
   • Specify the ID or name of the n8n sub-workflow responsible for creating alerts in TheHive.
   • Map the input data from this workflow to the expected input of your TheHive sub-workflow.
8. Activate the workflow: Once configured, activate the workflow. You can run it manually using the "Manual Trigger" or enable the "Schedule Trigger" for automated execution.