Qualys Security Operations Agent for Slack

Unlock On-Demand Security Operations with this Automation Agent

This n8n workflow acts as an intelligent agent, bridging Slack with your Qualys security platform. It empowers users to initiate Qualys vulnerability scans and generate security reports using intuitive Slack commands and interactive modals. This significantly speeds up security task execution and makes Qualys functionalities more accessible to your team directly within their communication hub.

This agent has the following core abilities:

• Vulnerability Scanning Initiation: Trigger Qualys vulnerability scans on specified assets or groups.
• Security Report Generation: Create detailed security reports from Qualys using predefined templates.

Key Features & Benefits

• Slack-Native Interface: Initiate vulnerability scans and request reports without leaving your Slack workspace, using familiar slash commands or shortcuts.
• Interactive Modals: User-friendly forms pop up in Slack to collect necessary parameters for Qualys actions (e.g., scan titles, target asset groups, report templates, output formats).
• Seamless Qualys Integration: Connects to your Qualys Guard platform (via n8n sub-workflows) to execute scan and report generation commands accurately.
• Automated Workflow Orchestration: Intelligently routes user requests from Slack to the correct Qualys operations, parsing modal inputs to drive the sub-workflows.
• Reduced Context Switching: Empowers security teams, DevOps, and other relevant stakeholders to perform crucial security tasks quickly from their primary communication tool, enhancing productivity.
• Extensible & Customizable: Easily adapt the Slack modal fields and the underlying n8n sub-workflow parameters to match your specific Qualys configuration, security policies, and reporting needs.

• An n8n instance (Cloud or self-hosted).
• Qualys API credentials and access to the Qualys platform for the sub-workflows.
• Slack API credentials (specifically for a Slack App with permissions to open views and interact with webhooks/slash commands).
• The two associated n8n sub-workflows: one for 'Qualys Start Vulnerability Scan' (referenced by ID pYPh5FlGZgb36xZO in the template) and one for 'Qualys Create Report' (referenced by ID icSLX102kSS9zNdK in the template). These must be imported and correctly configured in your n8n instance.

1. Download the n8n workflow JSON file for this main 'Qualys Slack Security Operations Agent' workflow.
2. Download the JSON files for the two required sub-workflows: 'Qualys Start Vulnerability Scan' and 'Qualys Create Report'.
3. Import all three workflows into your n8n instance.
4. Configure the 'Webhook' node in this main workflow: copy its Test URL. You will need to set this URL as the Request URL in your Slack App's 'Interactivity & Shortcuts' configuration or for your slash commands.
5. In the 'Vuln Scan Modal' and 'Scan Report Task Modal' (HTTP Request nodes), select or configure your Slack API credentials. Ensure your Slack App has the commands and chat:write (for modals) permissions, and potentially views.open if not covered by general bot scopes.
6. In the 'Qualys Start Vulnerability Scan' and 'Qualys Create Report' nodes (which are 'Execute Workflow' nodes), ensure the Workflow ID parameters correctly point to your imported and activated sub-workflows. You may need to manually select them after importing.
7. Configure the sub-workflows:
   • Update them with your Qualys API credentials where Qualys nodes are used.
   • Customize any Slack notification nodes within these sub-workflows to post results or confirmations to your desired Slack channels.
8. Set up Slack slash commands or shortcuts in your Slack App configuration to trigger the webhook URL from step 4. Ensure the callback_id sent by Slack matches the conditions in the 'Route Message' node (e.g., trigger-qualys-vmscan or qualys-scan-report).
9. Review and adjust the JSON bodies in the 'Vuln Scan Modal' and 'Scan Report Task Modal' nodes to customize the Slack modal content if needed. The current setup expects specific input field names which are then parsed by the 'Required Scan Variables' and 'Required Report Variables' nodes.
10. Activate all three workflows (this main workflow and the two sub-workflows).