Qualys (VM Parser)

PlexTrac supports importing XML files from Qualys. Qualys VM Parser is a tool developed by Qualys to help customers import vulnerability data from various sources. The Qualys VM Parser can read and import scan data in multiple formats.

When importing a file from Qualys, whether for the VM parser or Web parser, select "Qualys" from the import pulldown menu, and PlexTrac will decide which mapping to use based on the fields in the imported file.

Below are the mappings of fields and any reference notes to provide context. If a field is not listed, then PlexTrac does not currently import.

Finding Field Mappings

PlexTrac Field
Qualys Path
Notes

title

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><TITLE>

Any data surrounded by <![CDATA[some stuff]]> tag is removed before storing the data.

severity

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><SEVERITY>

We are passed a number, which gets evaluated as following: "0": "Informational", "1": "Informational", "2": "Low", "3": "Medium", "4": "High", "5": "Critical",

references

Any data surrounded by <![CDATA[some stuff]]> tag is removed before storing the data. All the data from the tags are stored into a list that is saved as reference links.

recommendations

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><SOLUTION>

Any data surrounded by <![CDATA[some stuff]]> tag is removed before storing the data.

description

Any data surrounded by <![CDATA[some stuff]]> tag is removed before storing the data. Data is combined.

risk_score

tags

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><SEVERITY>

If severity is 1, then we give it a tag of "minimal".

common_identifiers

evidence

<HOST_LIST><HOST><VULN_INFO_LIST><VULN_INFO><RESULT>

Any data surrounded by <![CDATA[some stuff]]> tag is removed before storing the data.

field: ["scores"]["cvss"]

label

Hardcoded "CVSS Base Score"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CVSS_SCORE><CVSS_BASE>

field: ["cvss_temporal"]

label

Hardcoded "CVSS Temporal Score"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CVSS_SCORE><CVSS_TEMPORAL>

field: ["scores"]["cvss3"]

label

Hardcoded "CVSSv3 Base Score"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CVSS3_SCORE><CVSS3_BASE>

field: ["cvss3_temporal"]

label

Hardcoded "CVSSv3 Temporal Score"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CVSS3_SCORE><CVSS3_TEMPORAL>

field: ["scores"]["pci_flag"]

label

Hardcoded "PCI_FLAG"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><PCI_FLAG>

field: ["cwe"]

label

Hardcoded "CWE"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CWE>

field: ["wasc"]

label

Hardcoded "WASC"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><WASC>

field: ["category"]

label

Hardcoded "Category"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><CATEGORY>

field: ["owasp"]

label

Hardcoded "OWASP"

value

<GLOSSARY><VULN_DETAILS_LIST><VULN_DETAILS><OWASP>

Asset Field Mappings

PlexTrac Field
Qualys Path
Notes

asset

<HOST_LIST><HOST><DNS> or <HOST_LIST><HOST><IP>

If DNS is NOT present, then it falls back to the IP element.

Last updated

Was this helpful?