Save Qualys Reports to TheHive Automation

The Save Qualys Reports to TheHive workflow streamlines security operations by automatically retrieving finished reports from the Qualys API, converting XML responses to JSON, and filtering out previously processed items based on timestamps. It then loops through new reports, creates dedicated cases in TheHive for each, and handles downloads to ensure comprehensive vulnerability tracking without manual intervention.

This workflow is ideal for Security Operations Centers (SOCs) managing ongoing vulnerability assessments. By running every hour, it provides real-time updates, reduces duplicate processing, and integrates two powerful security platforms seamlessly. Benefits include time savings on report handling, improved incident response speed, and centralized data in TheHive for better collaboration and alerting.

Use cases include continuous vulnerability monitoring in enterprise environments, automated triage for high-priority reports, and integration into broader SIEM or IR workflows. Customize global variables like base_url to fit your Qualys and TheHive setups for plug-and-play deployment.