Triggered from Slack Parent Workflow

This section is triggered by the parent n8n workflow, Qualys Slack Shortcut Bot. It is triggered when a user fills out the slack modal popup with data and hits the submit button.

These modals can be customized to perform various actions and are designed to be mobile-friendly, ensuring flexibility and ease of use.

Report ID are retrieved and the Scan report is requested from Qualys

In this section, the process begins with the "Fetch Report IDs" node, which performs an HTTP GET request to retrieve a list of available report templates.

This request utilizes predefined API credentials and the output, in XML format, is then converted to JSON by the "Convert XML to JSON" node for easier manipulation. Following this, the "Launch Report" node sends an HTTP POST request to Qualys to initiate the generation of a report based on parameters like the template ID, output format, and report title, which are dynamically sourced from global variables.

This node also includes additional configurations such as query parameters and headers to tailor the request. Finally, the "Convert Report Launch XML to JSON" node processes the XML response from the report launch, converting it into JSON format. This sequence ensures a streamlined and automated handling of report generation tasks within Qualys, facilitating efficient data processing and integration within the workflow.

n8n Loop Node

This node queries the report status at regular intervals (every minute) until the report is marked as finished. Once the report is complete, the loop ends, and the results are posted to Slack as a PDF attachment, ensuring the team is promptly informed.

For a SOC, continuous monitoring ensures timely updates, while automation of the waiting period frees up analysts' time for other tasks. Prompt notifications to Slack enable quick action on the completed reports, enhancing overall efficiency.

Check Status of Report in Qualys API

This node checks the status of the report in the Qualys API. After parsing the XML response to ensure the report is complete, it submits the report details to Slack.

This step is crucial for maintaining an automated and efficient workflow. For SOCs, automated monitoring reduces the need for manual checking, ensuring that only completed reports are processed further, which maintains data integrity.

Additionally, integrating with Slack streamlines operations by seamlessly communicating report statuses.

Upload Report to Slack

This node automates the process of uploading the generated report to a designated Slack channel.

By ensuring that the report, whether in PDF or HTML format, is easily accessible to the team, it streamlines communication and enhances collaboration.

For a Security Operations Center (SOC), this feature significantly improves accessibility, as team members can quickly access the latest reports directly from Slack.

It also enhances collaboration by sharing reports in a common communication platform and provides real-time updates, allowing for timely review and action.

Create Qualys Scan Slack Report Subworkflow

Introducing the Qualys Create Report Workflow—a robust solution designed to automate the generation and retrieval of security reports from the Qualys API.

This workflow is a sub workflow of the Qualys Slack Shortcut Bot workflow. It is triggered when someone fills out the modal popup in slack generated by the Qualys Slack Shortcut Bot.

When deploying this workflow, use the Demo Data node to simulate the data that is input via the Execute Workflow Trigger. That data flows into the Global Variables Node which is then referenced by the rest of the workflow.

It includes nodes to Fetch the Report IDs and then Launch a report, and then check the report status periodically and download the completed report, which is then posted to Slack for easy access.

For Security Operations Centers (SOCs), this workflow provides significant benefits by automating tedious tasks, ensuring timely updates, and facilitating efficient data handling.

How It Works:

• Fetch Report Templates: The "Fetch Report IDs" node retrieves a list of available report templates from Qualys. This automated retrieval saves time and ensures that the latest templates are used, enhancing the accuracy and relevance of reports.

• Convert XML to JSON: The response is converted to JSON format for easier manipulation. This step simplifies data handling, making it easier for SOC analysts to work with the data and integrate it into other tools or processes.

• Launch Report: A POST request is sent to Qualys to initiate report generation using specified parameters like template ID and report title. Automating this step ensures consistency and reduces the chance of human error, improving the reliability of the reports generated.

• Loop and Check Status: The workflow loops every minute to check if the report generation is complete. Continuous monitoring automates the waiting process, freeing up SOC analysts to focus on higher-priority tasks while ensuring they are promptly notified when reports are ready.

• Download Report: Once the report is ready, it is downloaded from Qualys. Automated downloading ensures that the latest data is always available without manual intervention, improving efficiency.

• Post to Slack: The final report is posted to a designated Slack channel for quick access. This integration with Slack ensures that the team can promptly access and review the reports, facilitating swift action and decision-making.

Get Started:

• Ensure your Slack and Qualys integrations are properly set up.
• Customize the workflow to fit your specific reporting needs.

Need Help?

• Join the discussion on our Forum or check out resources on Discord!

Deploy this workflow to streamline your security report generation process, improve response times, and enhance the efficiency of your security operations.

🔄This workflow is triggered by this slack modal. The Report Template Dropdown is powered by another Sub Workflow

🤖 Triggering this workflow is as easy as typing a backslash in Slack and filling out the modal on the right

Triggered from Slack Parent Workflow

Purpose and structure

This folder contains the Triggered from Slack Parent Workflow workflow. Its executable nodes use executeWorkflowTrigger, httpRequest, if, set, slack, splitInBatches, wait, xml. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

Execute Workflow Trigger

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Wait/0621_Wait_Slack_Monitor_Webhook.json MIT; preserve source notices.