qualys-cli 0.1.9__tar.gz → 0.3.0__tar.gz

{qualys_cli-0.1.9 → qualys_cli-0.3.0}/.gitignore

@@ -1,4 +1,5 @@
 .venv/
+.anthropic_key
 .install-check/
 __pycache__/
 *.pyc
@@ -38,3 +39,6 @@ user-prefs-export.xml
 api-model.json
 docs/design.md
 packaging/
+
+# Editor workspace files
+*.code-workspace

{qualys_cli-0.1.9 → qualys_cli-0.3.0}/CHANGELOG.md

@@ -6,6 +6,129 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-11-03
+
+### Added
+- `etm finding list/get/count` and `etm asset list/count` — ETM findings
+  and assets inventory resources (QQL `query`/`havingQuery`; findings
+  paginate by `page`, assets by `pageNumber`).
+- `cs k8s-resource namespace-list/namespace-get/pod-list/pod-get` —
+  Kubernetes namespace/pod inventory.
+- `cs secret-detector list/create/bulk-update` — secret detection rules.
+- `cs qid-list list/get/vulns` — QID lists used by CS policies.
+- `cs tag create/update/delete/assign/remove/exist` — CS tag management.
+- `ca isolation isolate/unisolate` — asset isolation by asset or tag ID.
+- `pm blocking-rule list/create/delete` — patch blocking rules.
+- `was catalog get/update` and `was option-profile update`.
+
+### Fixed
+- `__version__` reported `0.1.9` (User-Agent / version banner).
+- WAS `catalog update` values are CDATA-wrapped to prevent XML injection.
+
+### Changed
+- Doc ingestion: VM/PC sitemaps moved to
+  `en/vm/qweb-all-api/mergedProjects/qapi-*`; added WAS/TC/CA/CS/CSAM
+  sources. `api-model.json` refreshed (744 endpoints).
+- `scripts/diff_endpoints.py` — normalized old/new model endpoint delta.
+
+## [0.2.0] — 2026-09-21
+
+### Added
+- `cs k8s-cluster list/get` — Kubernetes cluster security (KCS). Path per
+  the gateway's own swagger: /csapi/v1.3/k8sClusters.
+- `cs policy list` — centralized image-assurance / CI-CD gate policies.
+- `pm mitigation plan` — available FIX-type mitigation scripts per QID
+  (POST /mtg/v1/vulnerabilities/mitigations; empty = patch-only QIDs).
+- `fim events` — File Integrity Monitoring event search (who changed what,
+  when). Note: pagination rides in the request body; the query param is
+  silently ignored by the API (verified live).
+- `edr events` — EDR endpoint telemetry search. The EDR API is served
+  under its platform module name, `/ioc/`.
+- `tc evaluation resources` — resources evaluated against one control
+  ("which S3 buckets fail X"), failing-only by default with per-resource
+  failure evidence. Filter field verified live: `resource.result:FAIL`
+  (bare `result:FAIL` is accepted but silently matches nothing).
+- `tc resource list` / `tc resource get` — cloud resource inventory with
+  failed-control counts. Note: this path family requires the UPPERCASE
+  provider segment (lowercase 404s misleadingly).
+- `pc exception list` — compliance exceptions/waivers with status,
+  expiration, policy/control filters.
+- `pc control list` — compliance controls; `--frameworks` adds SOC2/ISO/
+  NIST/CIS framework section mappings (details=All).
+- `asset tag list` — enumerate configured asset tags (id/name/parent),
+  the scoping unit for business-unit and team rollups.
+- `vm host detection` / `detection-stats`: `--include-ignored` surfaces
+  detections in the ignored/exception workflow.
+- `vm kb qvs` enumeration mode: search the CVE universe by QVS range and
+  NVD publish window (`--qvs-min/--qvs-max/--published-after/
+  --published-before/--modified-after`) with client-side
+  `--exploit-maturity/--threat-actor/--cisa-only` filters. Routes to the
+  v3 endpoint (v2 hard-requires a CVE list). Closes the largest coverage
+  gap found auditing the 923-question CRA bank.
+- `vm appliance list --full` — output_mode=full detail: last-connected
+  time, signature versions, interface config.
+- `pm patch list --platform` documents MacOS (value already passed
+  through; help text implied Windows|Linux only).
+- `vm host detection-stats`: `--qds` / `--qds-min` (Qualys Detection Score
+  aggregation: mean/max/critical count overall and per QID, server-side
+  QDS range filtering), `--sla-days N` (within/beyond share for arbitrary
+  SLA thresholds), `--fixed-since` (unambiguous "fixed in window" spelling),
+  `--top N` (configurable QID concentration list).
+- `vm kb qvs` — Qualys Vulnerability Score per CVE with contributing
+  factors (CVSS, EPSS, exploit maturity, threat actors, malware, CISA KEV
+  status + due date). JSON endpoint, ETag-cached.
+- `vm kb list --lean` — compact records (qid/title/severity/cves/patchable/
+  kev) instead of ~76KB-per-QID full entries; sized for LLM context windows.
+- `vm host list`: `--show-trurisk`, `--trurisk-min/--trurisk-max` — TruRisk
+  score, asset criticality, and factors per host (documented Host List API
+  params).
+- `vm scan list --ref <scan_ref>` — single-scan drill-down with STATUS /
+  SUB_STATE and option-profile detail for diagnosing errored scans.
+- `vm host exists` — disambiguates "host has no matching detections" from
+  "host is not in the subscription", with per-host last-scan freshness.
+- `QUALYS_FO_API_VERSION=3|4` — opt-in migration off the End-of-Service
+  /api/2.0/fo/ paths for the versioned endpoints (host list, detection,
+  knowledge base, QVS). v3/v4 authenticate with JWT bearer (exchanged and
+  cached automatically) instead of Basic auth. Default remains v2 until
+  the EOL date approaches.
+- `vm host detection-stats` — population-level aggregates (MTTR / backlog age)
+  in one command: paginates the full matching detection population internally
+  with lean server-side params and returns count, mean/median/p25/p75/min/max
+  days, an age histogram, per-severity and top-QID breakdowns, plus a
+  `definition` field stating exactly what the metric measures. Built for
+  MCP/agent callers so "what's our MTTR" is one tool call, not dozens.
+- `vm host detection-stats --kev` — restrict any stats query to CISA KEV
+  vulnerabilities. Resolves the KEV QID set internally and filters
+  client-side (no Qualys API version supports server-side threat-intel
+  filtering — verified against v2 and v4).
+- `vm kb kev-qids` — enumerate the full QID set covering the CISA KEV
+  catalog (public CISA feed → chunked, parallel, ETag-cached KB mapping;
+  ~4 min cold, sub-second warm).
+- `vm host detection`: new server-side cost-cutting options `--status`,
+  `--detection-updated-since`, `--show-results/--no-show-results`,
+  `--show-igs/--no-show-igs`.
+- `client.cached_get_xml()` — ETag/soft-TTL cached XML GET, mirroring
+  `cached_get_json`; `vm kb list` now uses it (repeat catalog queries
+  revalidate instead of re-downloading multi-MB responses).
+
+### Fixed
+- `vm host list` / `vm host detection`: `--limit` is now sent server-side as
+  `truncation_limit`. Previously it was applied client-side after the API
+  had evaluated and serialized the full result set (observed: an 88 MB /
+  497 s response trimmed locally to 3 rows).
+- `vm scan list --limit` now bounds JSON output (the scan list API has no
+  truncation param and the limit was only applied to table renders —
+  `--limit 8` returned the full 554-scan history).
+- For windowed MTTR queries, detections whose fix predates the
+  `--detection-updated-since` window are excluded and counted in
+  `dropped_fixed_before_window` (the server filters on record-update time,
+  not fix time).
+- Percentiles use inclusive interpolation (`statistics.quantiles`); the
+  previous nearest-rank-via-`round()` biased small-sample medians low.
+- Test suite no longer reads or writes the developer's real
+  `~/.config/qualys-cli/` (config, cache, install-id are isolated per-test;
+  a canary test guards the invariant).
+
 ## [0.1.9] — 2026-08-12
 
 ### Changed

{qualys_cli-0.1.9 → qualys_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qualys-cli
-Version: 0.1.9
+Version: 0.3.0
 Summary: Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management).
 Project-URL: Homepage, https://www.qualys.com
 Author-email: Qualys <support@qualys.com>

{qualys_cli-0.1.9 → qualys_cli-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qualys-cli"
-version = "0.1.9"
+version = "0.3.0"
 description = "Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }

qualys_cli-0.3.0/src/qualys_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"