regscale-cli 6.20.9.1__py3-none-any.whl → 6.21.0.0__py3-none-any.whl

regscale/models/integration_models/qualys.py

@@ -9,7 +9,7 @@ import logging
 import re
 from calendar import firstweekday
 from datetime import datetime
-from typing import Any, Iterator, Optional, TypeVar, TextIO, Union
+from typing import Any, Iterator, List, Optional, TextIO, TypeVar, Union
 
 from openpyxl.reader.excel import load_workbook
 from pandas import Timestamp
@@ -17,20 +17,21 @@ from pandas import Timestamp
 from regscale.core.app import create_logger
 from regscale.core.app.application import Application
 from regscale.core.app.utils.app_utils import get_current_datetime
-from regscale.core.app.utils.parser_utils import safe_int, safe_float
+from regscale.core.app.utils.parser_utils import safe_float, safe_int
 from regscale.core.utils.date import date_str, datetime_str
-from regscale.integrations.scanner_integration import IntegrationAsset
+from regscale.integrations.scanner_integration import IntegrationAsset, IntegrationFinding
 from regscale.models import (
     Asset,
     AssetCategory,
+    AssetStatus,
     AssetType,
     ImportValidater,
     IssueSeverity,
+    IssueStatus,
     SecurityPlan,
     Vulnerability,
-    VulnerabilityStatus,
-    AssetStatus,
     VulnerabilitySeverity,
+    VulnerabilityStatus,
 )
 from regscale.models.integration_models.flat_file_importer import FlatFileImporter
 
@@ -50,6 +51,18 @@ FQDN = "FQDN"
 IMAGE_ID_FIELD = "IMAGE ID"
 CVE_ID_FIELD = "CVE ID"
 
+SEVERITY_MAP = {
+    "critical": IssueSeverity.Critical,
+    "high": IssueSeverity.High,
+    "medium": IssueSeverity.Moderate,
+    "moderate": IssueSeverity.Moderate,
+    "low": IssueSeverity.Low,
+    "informational": IssueSeverity.NotAssigned,
+    "none": IssueSeverity.NotAssigned,
+    "info": IssueSeverity.NotAssigned,
+    "unknown": IssueSeverity.NotAssigned,
+}
+
 
 class Qualys(FlatFileImporter):
     """Qualys Scan information"""
@@ -94,36 +107,30 @@ class Qualys(FlatFileImporter):
         # header is line# 11
         # start self.file_data from line #12
 
-    def create_asset(self, dat: Optional[dict] = None) -> Optional[Asset]:
+    def create_asset(self, dat: Optional[dict] = None) -> Optional[IntegrationAsset]:
         """
-        Create an asset from a row in the Qualys file
+        Create an integration asset from a row in the Qualys file
 
         :param Optional[dict] dat: Data row from CSV file
-        :return: RegScale Issue object or None
-        :rtype: Optional[Asset]
+        :return: RegScale IntegrationAsset object or None
+        :rtype: Optional[IntegrationAsset]
         """
-        return Asset(
-            **{
-                "id": 0,
-                "name": self.mapping.get_value(dat, DNS),
-                "ipAddress": self.mapping.get_value(dat, IP),
-                "isPublic": True,
-                "status": "Active (On Network)",
-                "assetCategory": "Hardware",
-                "qualysId": str(self.mapping.get_value(dat, QG_HOST_ID)),  # UUID from Nessus HostProperties tag
-                "bLatestScan": True,
-                "bAuthenticatedScan": True,
-                "scanningTool": "Qualys",
-                "assetOwnerId": self.attributes.app.config["userId"],
-                "netBIOS": self.mapping.get_value(dat, NETBIOS),
-                "assetType": "Other",
-                "fqdn": self.mapping.get_value(dat, FQDN),
-                "operatingSystem": Asset.find_os(self.mapping.get_value(dat, OS)),
-                "operatingSystemVersion": self.mapping.get_value(dat, OS),
-                "systemAdministratorId": self.attributes.app.config["userId"],
-                "parentId": self.attributes.parent_id,
-                "parentModule": self.attributes.parent_module,
-            }
+        qid = str(self.mapping.get_value(dat, QG_HOST_ID))
+        return IntegrationAsset(
+            name=self.mapping.get_value(dat, DNS),
+            ip_address=self.mapping.get_value(dat, IP),
+            status=AssetStatus.Active.value,
+            cpu=0,
+            ram=0,
+            asset_category="Hardware",
+            identifier=qid,  # UUID from Qualys Host ID
+            other_tracking_number=qid,
+            scanning_tool="Qualys",
+            asset_owner_id=self.attributes.app.config["userId"],
+            asset_type="Other",
+            fqdn=self.mapping.get_value(dat, FQDN),
+            operating_system=Asset.find_os(self.mapping.get_value(dat, OS)),
+            os_version=self.mapping.get_value(dat, OS),
         )
 
     def _convert_datetime_to_str(self, input_date: Union[Timestamp, datetime]) -> str:
@@ -140,59 +147,43 @@ class Qualys(FlatFileImporter):
             return input_date
         return input_date.strftime(self.dt_format)
 
-    def create_vuln(self, dat: Optional[dict] = None, **kwargs) -> Optional[Vulnerability]:
+    def create_vuln(self, dat: Optional[dict] = None, **kwargs) -> Optional[IntegrationFinding]:
         """
-        Create a vuln from a row in the Qualys file
+        Create a finding from a row in the Qualys file
 
         :param Optional[dict] dat: Data row from CSV file, defaults to None
-        :return: RegScale Vulnerability object or None
-        :rtype: Optional[Vulnerability]
+        :rtype: IntegrationFinding
         """
         from regscale.integrations.commercial.qualys import map_qualys_severity_to_regscale
 
-        dns: str = self.mapping.get_value(dat, DNS)
-        other_id: str = self.mapping.get_value(dat, QG_HOST_ID)
-        distro: str = self.mapping.get_value(dat, OS)
+        finding: Optional[IntegrationFinding] = None
+        qid = str(self.mapping.get_value(dat, QG_HOST_ID))
         cve: str = self.mapping.get_value(dat, CVE_ID)
         description: str = self.mapping.get_value(dat, "Threat")
         title = self.mapping.get_value(dat, self.vuln_title)
-        regscale_vuln = None
         severity = self.mapping.get_value(dat, SEVERITY)
         regscale_severity = map_qualys_severity_to_regscale(int(severity))[1]
-        config = self.attributes.app.config
-        asset_match = [asset for asset in self.data["assets"] if asset.name == dns]
-        asset = asset_match[0] if asset_match else None
-        last_seen = self._convert_datetime_to_str(self.mapping.get_value(dat, "Last Detected"))
-        first_seen = self._convert_datetime_to_str(self.mapping.get_value(dat, "First Detected"))
-
-        if dat and asset_match:
-            regscale_vuln = Vulnerability(
-                id=0,
-                scanId=0,  # set later
-                parentId=asset.id,
-                parentModule="assets",
-                ipAddress=self.mapping.get_value(dat, IP),
-                lastSeen=last_seen,
-                firstSeen=first_seen,
-                daysOpen=None,
-                dns=self.mapping.get_value(dat, DNS, other_id),
-                mitigated=None,
-                operatingSystem=(Asset.find_os(distro) if Asset.find_os(distro) else None),
-                severity=regscale_severity,
-                plugInName=self.mapping.get_value(dat, self.vuln_title),
-                plugInId=self.mapping.get_value(dat, "QID"),
-                cve=cve,
-                vprScore=None,
-                cvsSv3BaseScore=self.extract_float(self.mapping.get_value(dat, "CVSS3.1 Base", 0.0)),
-                tenantsId=0,
+        if dat:
+            finding = IntegrationFinding(
+                control_labels=[],  # Add an empty list for control_labels
                 title=title,
                 description=description,
-                plugInText=title,
-                createdById=config["userId"],
-                lastUpdatedById=config["userId"],
-                dateCreated=get_current_datetime(),
+                ip_address="0.0.0.0",
+                cve=cve,
+                severity=regscale_severity,
+                asset_identifier=qid,
+                plugin_name=description,
+                plugin_id=str(self.mapping.get_value(dat, "QID")),
+                cvss_v3_score=self.extract_float(self.mapping.get_value(dat, "CVSS3.1 Base", 0.0)),
+                plugin_text=title,
+                category="Hardware",
+                status=IssueStatus.Open,
+                first_seen=self._convert_datetime_to_str(self.mapping.get_value(dat, "First Detected")),
+                last_seen=self._convert_datetime_to_str(self.mapping.get_value(dat, "Last Detected")),
+                vulnerability_type="Vulnerability Scan",
+                baseline=f"{self.name} Host",
             )
-        return regscale_vuln
+        return finding
 
     @staticmethod
     def extract_float(s: Union[str, float, int]) -> Optional[float]:
@@ -230,6 +221,7 @@ class QualysContainerScansImporter(FlatFileImporter):  # (ScannerIntegration):
     last_seen_field = "UPDATED"
     container_id = "IMAGE UUID"
     records = []
+    title = "Qualys Container Scanner Export Integration"  # Add explicit title for source report identification
 
     def __init__(self, **kwargs: dict):
         self.asset_identifier_field = "otherTrackingNumber"
@@ -278,26 +270,25 @@ class QualysContainerScansImporter(FlatFileImporter):  # (ScannerIntegration):
             **kwargs,
         )
 
-    def create_asset(self, row: Optional[dict] = None, **kwargs) -> Optional[Asset]:
+    def create_asset(self, row: Optional[dict] = None, **kwargs) -> Optional[IntegrationAsset]:
         """
         Fetch assets from the Qualys CSV file
 
-        :return: Iterator of IntegrationAsset objects
-        :rtype: Iterator[IntegrationAsset]
+        :return: IntegrationAsset object
+        :rtype: Optional[IntegrationAsset]
         """
         bad_ids = ["", "0", "None", "Unknown"]
         if self.mapping.get_value(row, self.container_id) in bad_ids:
             return None
         max_length = 450  # max length of asset name
-        asset = Asset(
+        container_id = self.mapping.get_value(row, self.container_id)
+        asset = IntegrationAsset(
             name=self.mapping.get_value(row, self.asset_notes_field)[:max_length] or "Unknown",
             notes=self.mapping.get_value(row, self.asset_notes_field),
-            otherTrackingNumber=self.mapping.get_value(row, self.container_id),
-            # identifier=self.mapping.get_value(row, IMAGE_ID_FIELD),
-            assetType=AssetType.VM.value,
-            assetCategory=AssetCategory.Software.value,
-            parentId=safe_int(self.plan_id),
-            parentModule=SecurityPlan.get_module_slug(),
+            identifier=container_id,
+            other_tracking_number=container_id,
+            asset_type=AssetType.VM.value,
+            asset_category=AssetCategory.Software.value,
             status=AssetStatus.Active,
         )
         return asset
@@ -316,34 +307,44 @@ class QualysContainerScansImporter(FlatFileImporter):  # (ScannerIntegration):
         )
         return date_str(date_obj_value, self.dt_format)
 
-    def create_vuln(self, row: Optional[dict] = None, **kwargs) -> Optional[Vulnerability]:
+    def create_vuln(self, row: Optional[dict] = None, **kwargs) -> Iterator[IntegrationFinding]:
         """
         Fetch vulnerabilities from the Qualys CSV file
 
         :return: Iterator of IntegrationFinding objects
-        :rtype: Vulnerability
+        :rtype: Iterator[IntegrationFinding]
         """
-
+        findings: List[IntegrationFinding] = []
+        title = self.mapping.get_value(row, self.title_field)
+        description = self.mapping.get_value(row, self.threat_field)
+        qid = str(self.mapping.get_value(row, self.container_id))
         if self.mapping.get_value(row, CVE_ID_FIELD) and isinstance(self.mapping.get_value(row, CVE_ID_FIELD), str):
             for cve_id in self.mapping.get_value(row, CVE_ID_FIELD, "").split(","):
-                finding = Vulnerability(
+                finding = IntegrationFinding(
+                    control_labels=[],  # Add an empty list for control_labels
                     title=self.mapping.get_value(row, self.title_field),
                     description=self.mapping.get_value(row, self.threat_field),
                     cve=cve_id,
                     severity=severity_to_regscale(self.mapping.get_value(row, self.severity_field)),
-                    status=VulnerabilityStatus.Open,
-                    cvsSv3BaseScore=safe_float(self.mapping.get_value(row, self.cve_v3_base, 0.0)),
-                    vprScore=safe_float(self.mapping.get_value(row, self.cve_base, 0.0)),
-                    firstSeen=self.handle_integration_date(
+                    asset_identifier=qid,
+                    plugin_name=description,
+                    plugin_id=str(self.mapping.get_value(dat, "QID")),
+                    cvss_v3_score=safe_float(self.mapping.get_value(row, self.cve_v3_base, 0.0)),
+                    vpr_score=safe_float(self.mapping.get_value(row, self.cve_base, 0.0)),
+                    plugin_text=title,
+                    category="Hardware",
+                    status=IssueStatus.Open,
+                    first_seen=self.handle_integration_date(
                         self.mapping.get_value(row, self.first_seen_field, get_current_datetime())
                     ),
-                    lastSeen=self.handle_integration_date(
+                    last_seen=self.handle_integration_date(
                         self.mapping.get_value(row, self.last_seen_field, get_current_datetime())
                     ),
-                    plugInName=cve_id,
-                    dns=self.mapping.get_value(row, self.container_id),  # really asset_identifier
+                    vulnerability_type="Vulnerability Scan",
+                    baseline=f"{self.name} Host",
                 )
-                return finding
+                findings.append(finding)
+        yield from findings
 
 
 class QualysWasScansImporter(FlatFileImporter):
@@ -365,6 +366,7 @@ class QualysWasScansImporter(FlatFileImporter):
     container_id = "ID"
     row_key = "VULNERABILITY"
     records = []
+    title = "Qualys WAS Scanner Export Integration"  # Add explicit title for source report identification
 
     def __init__(self, **kwargs: dict):
         self.asset_identifier_field = "otherTrackingNumber"
@@ -561,6 +563,8 @@ class QualysWasScansImporter(FlatFileImporter):
         :rtype: Vulnerability
         """
         # additional_fields = ["Title", "Severity Level", "CVSS Base", "CWE", "Solution"]
+        asset_identifier = self.mapping.get_value(row, self.container_id)
+
         finding = Vulnerability(
             title=row.get("Title", self.mapping.get_value(row, "Url")),
             description=row.get("Solution"),
@@ -576,7 +580,8 @@ class QualysWasScansImporter(FlatFileImporter):
                 self.mapping.get_value(row, self.last_seen_field, get_current_datetime())
             ),
             plugInName=row.get("CWE"),
-            dns=self.mapping.get_value(row, self.container_id),  # really asset_identifier
+            dns=asset_identifier,  # Use consistent asset identifier
+            assetIdentifier=asset_identifier,  # Add explicit asset identifier
         )
         return finding
 
@@ -588,6 +593,7 @@ class QualysPolicyScansImporter(FlatFileImporter):
 
     plan_id = 0
     records = []
+    title = "Qualys Policy Scanner Export Integration"  # Add explicit title for source report identification
 
     def __init__(self, **kwargs: dict):
         self.asset_identifier_field = "qualysId"