Blog 3: Qualys & Morning Dashboard Reporting

Qualys & Morning Dashboard Reporting

 

Problem Statement:

As per the customer requirement, they want to know the daily vulnerability status of the 2 of their total process which is critical & priority for them. And 2^nd criteria were, they only want to know the Count of Open Vulnerability & Count of Fixed vulnerability.

Solution:

So, we created our own custom dashboard in Qualys. Qualys provides dashboard & widgets feature with the use of QQL Query, to get the overview report to user. We have created one dashboard & added few widgets using custom QQL Query (as per requirement).

Name of the widgets & descriptions are as below:

Sr. No	Widget Title	Description
1	Asset Count	These aren’t total inventory. These are assets which have Qualys Agent/Scanner installed & VM license (assigned VM module).
2	Inactive asset count	Asset’s which are inactive since few weeks.
3	Inactive Asset VM count	Total Vulnerabilities count of inactive assets (refer 2nd point)
4	Active Asset Count	Asset’s which are Active since few weeks.
5	Active Asset VM count	Total Vulnerabilities count of Active assets (refer 4th point)
6	Total Vulnerability count	Total vulnerability count of assets (VM module assigned) since day 1, including New Vulnerabilities, Open vulnerabilities, Fixed Vulnerabilities, Reopened Vulnerabilities.
7	Total Open Vulnerability count	Open Vulnerabilities count from Total vulnerabilities (refer point 6).
8	Total Qualys Patchable Vulnerabilities	Patchable Vulnerabilities count from Total Open vulnerabilities (refer point 7).
9	Total Vulnerability Fixed	Fixed Vulnerabilities from Total Vulnerabilities Count (refer point 6).
10	Fixed Vulnerability in 7 Days	Fixed Vulnerabilities in last 7 days, from Total Vulnerability Fixed (refer point 9).

Note: Week defined as per business requirement.

I’m also sharing the screenshot of dashboard, for reference:

 

We’ve fulfilled the 1^st requirement and for the 2^nd requirement, I’ve marked widgets below, that 2 criteria, Open Vulnerability & Fixed vulnerability. Sharing below the screenshot:

 

Note: Above I’ve shared 2 process screenshot report, for reference.

Earlier we used to share above screenshot only. But after few days, I observed something is missing. Few questions came in mind, like as compare to the yesterday’s report:

1. How much vulnerability Opened? In how many assets?

2. How much vulnerability Fixed? In how many assets?

3. Etc.

So, I thought to provide customer, some value-added report. So I created excel with following columns:

Sr. No	Column Title	Description
1	DATE	Current Date
2	PROCESS	Process name
3	OPEN (yesterday’s date)	Open vulnerability count as on yesterday
4	OPEN (today’s date)	Open vulnerability count as on today
5	DIFFERENCE (OPEN)	Change In vulnerability count in 24hrs
6	FIXED (yesterday’s date)	Fixed vulnerability count as on yesterday
7	FIXED (today’s date)	Fixed vulnerability count as on today
8	DIFFERENCE (FIXED)	Change In vulnerability count in 24hrs

 

Sharing below the screenshot of excel sheet:

 

For clear understanding, we daily used to share only current date report, not entire sheet, like below:

Customer & my senior managers were happy with above report.

I didn’t stopped here. With time & using daily, I’ve observed one problem. From dashboard, we used to write manually in sheet. Some of the words & contents are repeating like increase, decrease, copying yesterday’s count. So I used some excel formulas to minimize the time & effort. Results is, User need to just drag the last 4 rows, which looks like below:

 

User need to change only current day OPEN & FIXED Vulnerability count, difference calculation will done automatically:

 

Conclusion:

- Requirement has been fulfilled.

- I’ve observed some problem & implemented solutions.

- It saved lots of regular manual efforts & time.