'%(asctime)s - %(name)s - %(levelname)s - %(message)s',
'%Y-%m-%d %H:%M:%S')
fh.setFormatter(formatter)
dbLogger.addHandler(fh)
consoleHandler = logging.StreamHandler()
consoleHandler.setFormatter(formatter)
logger.addHandler(consoleHandler)
dbLogger.addHandler(consoleHandler)
logger.debug('Initializing controller')
logger.debug('Reading config file')
config = configparser.ConfigParser()
config.read('qualys_scan.conf')
db = MysqlApi(config['ops-dev.db'])
qApi = QualysApi(config['qualysApiConf'], config['proxy'])
rList = {} # :list : list of reports which are currently being processed
sList = {} # :list : list of scans which are currently being processed
scan_conf1 = {
'scan_title': 'skganws001.prg-dc.dhl.com',
'option_title': 'API-OAT-VMS',
'iscanner_name': 'prgdca-qua01',
'priority': '5',
'ip': '2.222.36.31',
}
scan_conf2 = {
'scan_title': 'skganws001.prg-dc.dhl.com',
'option_title': 'API-OAT-VMS',
'iscanner_name': 'prgdca-qua01',
return cfg
def get_apps_dir():
import os
storageconfig = get_splunk_config("server", "pooling")
if storageconfig["state"].lower() == "enabled" and len(storageconfig["storage"]) > 0:
return os.path.join(storageconfig["storage"], "etc", "apps")
else:
return os.path.join(os.environ["SPLUNK_HOME"], "etc", "apps")
cfg = get_splunk_config("qualys", "api")
qualys = QualysApi(cfg["username"], cfg["password"], cfg["endpoint"])
checkpoint_file = os.path.join(get_apps_dir(), "TA-qualys", "local", "scans.checkpoint")
if os.path.exists(checkpoint_file):
checkpoint = datetime_from_isotime(open(checkpoint_file).read().strip())
else:
# Epoch
checkpoint = datetime.datetime.fromtimestamp(0)
chk = None # updated checkpoint
for scan in qualys.scans:
scan_status = scan.find("./STATUS/STATE").text.lower()
scan_dt = datetime_from_isotime(scan.find("./LAUNCH_DATETIME").text)
if scan_dt <= checkpoint:
# Already indexed
cfg[opt] = cfgparse.get(section, opt)
return cfg
def get_apps_dir():
import os
storageconfig = get_splunk_config("server", "pooling")
if storageconfig["state"].lower() == "enabled" and len(storageconfig["storage"]) > 0:
return os.path.join(storageconfig["storage"], "etc", "apps")
else:
return os.path.join(os.environ["SPLUNK_HOME"], "etc", "apps")
cfg = get_splunk_config("qualys", "api")
qualys = QualysApi(cfg["username"], cfg["password"], cfg["endpoint"])
###
with tempfile.TemporaryFile() as f:
r = qualys._get("/knowledge_base/vuln/", params={"action": "list"})
for chunk in r.iter_content(1024):
f.write(chunk)
f.seek(0)
xml = ET.ElementTree()
xml.parse(f)
###
severity_to_splunk = {
"1": "informational",
"2": "medium",