Illumio Core 23.5 Administration Guide

Starting from the release of CLI 1.4.0, Qualys supports API downloads with some minor differences in options.

For the release CLI 1.4.1, it is suggested that users use an API key instead of a login session while using Qualys API download.

For the release CLI 1.4.2 for Tenable, the most reliable way to provide authentication is through API keys instead of username/password. If customers observe any authentication issues while using Tenable SC API upload, they are advised to use API keys.

There are 2 ENV variables to set up the Tenable SC API keys which are used for authentication:

TSC_ACCESS_KEY

TSC_SECRET_KEY

The API connects directly to the cloud instance of Tenable or Qualys and the vulnerability tool then scans new vulnerabilities and downloads them into the PCE.

Users can also set up cron jobs that run in the desired intervals and check the state of the vulnerability scanner.

Qualys and Tenable scanners work in a similar way, using the username and password and similar options.

There are two kinds of upload: non-authoritative and authoritative.

After either kind of upload, you can examine the uploaded data with the CLI Tool or the PCE web console. See “Vulnerability Maps” in the Visualization Guide for information.

The CLI Tool works with vulnerability data from the following sources.

Windows systems take up to four options with the ILO command for the vulnerability data upload. Users who choose to use more optional parameters must set api-server, username, and password as the environmental variables to use other options in the command.

See "Vulnerability Maps" in Visualization Guide for information.

In this example, the --source-scanner nessus-pro option indicates that the data comes from Nessus Professional. On Windows, provide the absolute path to the data file. This Windows example is broken across several lines with the PowerShell line continuation character (`).

C:\Users\donald.knuth> ilo upload_vulnerability_report `
--input-file C:\Users\donald.knuth\Desktop\vuln_reports\nessus3.xml `
--source-scanner nessus-pro --format xml

Elapsed Time [0.05 (total : 0.05)] - Data parsing is done. 
Elapsed Time [1.08 (total : 1.13)] - Got workloads. Workload count: 5. 
Elapsed Time [0.0 (total : 1.13)] - Built workload interface mapping. Total interfaces : 11. 
Elapsed Time [4.57 (total : 5.7)] - Imported Vulnerabilities..
Elapsed Time [0.0 (total : 5.7)] - Detected Vulnerabilities are associated with vulnerability and workload data.. 
Elapsed Time [0.83 (total : 6.53)] - Report Imported. 

Summary: 
Processed the report with the following details : 
Report meta data => 
Name          : Generic 
Report Type   : nessus 
Authoritative : false 
Scanned IPs   : ["10.1.0.74", "10.1.0.223", "10.1.0.232", "10.1.0.221", "10.1.0.11", "10.1.0.82", "10.1.0.43", "10.1.0.91", "10.1.0.8", "10.1.1.250"] 

Stats : 
   Number of vulnerabilities           => 19 
   Number of detected vulnerabilities  => 31 

Done.

The syntax for uploading vulnerability data from Rapid7 is identical to the syntax for uploading vulnerability data from Qualys. On Windows, you use the --format qualys option and the absolute path to the data file. This Windows example is broken across several lines with the PowerShell line continuation character (`).

Rapid7 data exported in Qualys format.

Before uploading to the PCE, Rapid7 vulnerability data must have been exported in Qualys format from Rapid7 with Qualys XML Export.

C:\Users\edward.teller> ilo upload_vulnerability_report `
--input-file C:\Users\edward.teller\Desktop\vuln_reports\rapid7.xml `
--source-scanner qualys --format xml
...
Done.

In this example, the prompt shows this is an authoritative upload.

To proceed, you must enter the word YES in all capital letters.

C:\Users\jrobert.oppenheimer> ilo upload_vulnerability_report --input-file dataDir/authoritativedata.xml --authoritative --source-scanner qualys --format xml

Using /home/centos/.rvm/gems/ruby-2.4.1 
Authoritative scan overwites the previous entries for all the ips within this scan. There is no ROLLBACK 
Are you sure this is an authoritative scan? (YES | NO) 
YES 
Elapsed Time [11.86 (total : 11.86] - Data parsing is done. 
Elapsed Time [0.27 (total : 12.13] - Got workloads. Workload count: 3. 
Elapsed Time [0.0 (total : 12.13] - Built workload interface mapping. Total interfaces : 6. 
Elapsed Time [3.02 (total : 15.15] - Imported Vulnerabilities.. 
Elapsed Time [0.0 (total : 15.15] - Detected Vulnerabilities are associated with vulnerability and workload data.. 
Elapsed Time [0.84 (total : 16.0] - Report Imported. 
Summary: 
Processed the report with the following stats - 
    Number of vulnerabilities           => 14 
    Number of detected vulnerabilities  => 48 
Done.

This example uses a single Qualys vulnerability identifier to show the associated vulnerability. The value passed to the --reference-id option is shown as qualys-38173. See Vulnerability Identifier for information.

$ ilo vulnerability read --xorg-id=1 --reference-id=qualys-38173
...

| Attribute | Value | 
+-------------+----------------------------------------------------------------+ 
| href | /orgs/1/vulnerabilities/qualys-38173 | 
| name | SSL Certificate - Signature Verification Failed Vulnerability 
| score | 39 | 
| cve_ids | [] | 
| created_at | 2018-11-05T18:16:56.846Z | 
...

This example highlights the vulnerability identifier, the CVE identifiers, and the description of the CVE. See Common Vulnerabilities and Exposures (CVE) and Vulnerability Identifier for information. The layout of the output is the same for all supported vulnerability data sources.

Nessus Professional

C:\Users\werner.heisenberg> ilo vulnerability list --xorg-id=1
... 
| Href | Name | Score | Description | Cve Ids | Created At | Updated At | Created By | Updated By | 
---------------------+--------------------------+----------------------+-----------------------+ 
| /orgs/1/vulnerabilities/nessus-18405 | Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness | 51    |             | ["CVE-2005-1794"]                  | 2018-11-07T03:15:39.410Z | 2018-11-07T03:15:39.410Z | {"href"=>"/users/1"} | {"href"=>"/users/1"} |
...

Qualys

C:\Users\isaac.newton> ilo vulnerability list --xorg-id=1 
... 
| Href | Name | Score | Description | Cve Ids | Created At | Updated At | Created By | Updated By | 
---------------------+--------------------------+----------------------+-----------------------+ 
| /orgs/1/vulnerabilities/qualys-38657 | Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32) | 69 | | ["CVE-2016-2183"] | 2018-07-27T18:16:57.166Z | 2018-08-08T22:30:32.421Z | {"href"=>"/users/1"} | {"href"=>"/users/16"} | 
...

Rapid7

Because Rapid7 vulnerability data must be in Qualys format before upload, the output is the same as for Qualys data, including the vulnerability identifier (qualys-38657 in the example above) and CVE. See Common Vulnerabilities and Exposures (CVE) and Vulnerability Identifier for information.

The Report Type column identifies the source of the scan; in this example, Qualys.

C:\Users\gracemurry.hopper> ilo vulnerability_report list --xorg-id=1 
... 
| Href | Report Type | Name | Created At | Updated At | Num Vulnerabilities | Created By | Updated By | 
+-----------------------------------------------------+-------------+----------------------+--------------------------+---------------------- 
| /orgs/1/vulnerability_reports/scan_1502310096_09344 | qualys  | NewAuthoritativeScan | 2018-08-08T22:30:34.877Z | 2018-08-08T22:30:34.877Z | 62 | {"href"=>"/users/16"} | {"href"=>"/users/16"} | 
...

upload_vulnerability_report --source-scanner  qualys --format api 
--api-server qualysguard.qg3.apps.qualys.com  --api-user um3sg 
--scanned-after 2021-09-20