[qualys_vmdr] Update the logic for populating the vulnerability.* fields by brijesh-elastic · Pull Request #14791 · elastic/integrations

brijesh-elastic · 2025-08-04T08:57:34Z

Proposed commit message

qualys_vmdr: update logic for populating vulnerability.{score.base,score.version,severity}

The vulnerability.score.version field is not always populating because
it was introduced before the CDR workflow. Back then, we were calling a
single API, and the logic attempted to parse the version from
QDS_FACTORS. However, since the introduction of the CDR work and the
knowledge base API, which contains more accurate fields for parsing
both vulnerability.score.version and vulnerability.score.base

Additionally, we are updating the vulnerability.severity enums to align
with the CVSS standard.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/qualys_vmdr directory.
Run the following command to run tests.

elastic-package test

Related issues

…bility.score.version, and vulnerability.severity fields

elasticmachine · 2025-08-04T08:57:38Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

brijesh-elastic · 2025-08-04T09:03:49Z

packages/qualys_vmdr/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml

        // CVSS score between 9.0 and 10.0)
        if (9.0 <= ctx.vulnerability.score.base) {
-          ctx.vulnerability.severity = "critical";
+          ctx.vulnerability.severity = "Critical";


@maxcold, I've changed the current vulnerability.severity enums to match with CVSS standard. I hope this doesn't break anything.

critical -> Critical high -> High medium -> Medium low -> Low none -> None

@brijesh-elastic @kcreddy thanks for checking! The casing shouldn't break anything. We already have a divergent casing between integrations, what's important is that the values are these ones, we made our code as case insesitive as we could

elastic-vault-github-plugin-prod · 2025-08-04T09:24:38Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

kcreddy

Could you add more details into commit message about the bug?

kcreddy · 2025-08-04T10:06:48Z

packages/qualys_vmdr/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml

+  - set:
+      field: vulnerability.score.base
+      tag: set_vulnerability_score_base_from_knowledge_base_cvss_base
+      copy_from: qualys_vmdr.asset_host_detection.knowledge_base.cvss.base
+      ignore_empty_value: true
+      if: ctx.vulnerability?.score?.base == null
+  - grok:
+      field: qualys_vmdr.asset_host_detection.knowledge_base.cvss.vector_string
+      tag: grok_to_extract_vulnerability_score_version
+      patterns:
+        - '^CVSS:%{DATA:vulnerability.score.version}/%{GREEDYDATA}$'
+        - '^%{GREEDYDATA}$'
+      ignore_missing: true
+      if: ctx.vulnerability?.score?.version == null


Can you add more test cases to cover these 2 processors to improve coverage?

kcreddy

LGTM, please merge after clarification is addressed #14791 (comment)

packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json

elasticmachine · 2025-08-04T14:29:59Z

💚 Build Succeeded

Buildkite Build
Commit: dbc5ef1

History

💚 Build #29519 succeeded f98cda6
💚 Build #29506 succeeded af78764

cc @brijesh-elastic

elastic-sonarqube · 2025-08-04T14:30:05Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

efd6 · 2025-08-05T01:16:58Z

Suggested edit for commit message:

qualys_vmdr: update logic for populating vulnerability.{score.base,score.version,severity}

The vulnerability.score.version field is not always populating because
it was introduced before the CDR workflow. Back then, we were calling a
single API, and the logic attempted to parse the version from
QDS_FACTORS. However, since the introduction of the CDR work and the
knowledge base API, which contains more accurate fields for parsing
both vulnerability.score.version and vulnerability.score.base

Additionally, we are updating the vulnerability.severity enums to align
with the CVSS standard.

(reducing length of title, wrapping body at 72, and removing markdown syntax)

kcreddy

LGTM

elastic-vault-github-plugin-prod · 2025-08-06T06:46:25Z

Package qualys_vmdr - 6.8.1 containing this change is available at https://epr.elastic.co/package/qualys_vmdr/6.8.1/

elastic-vault-github-plugin-prod · 2025-08-06T09:40:32Z

Package cloud_security_posture - 3.0.1 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.0.1/

Update the logic for populating the vulnerability.score.base, vulnera…

362a117

…bility.score.version, and vulnerability.severity fields

brijesh-elastic self-assigned this Aug 4, 2025

brijesh-elastic requested a review from a team as a code owner August 4, 2025 08:57

Update changelog entry

af78764

brijesh-elastic commented Aug 4, 2025

View reviewed changes

kcreddy added the Category: CDR label Aug 4, 2025

kcreddy reviewed Aug 4, 2025

View reviewed changes

Add a test case to increase coverage

f98cda6

brijesh-elastic requested a review from kcreddy August 4, 2025 10:44

kcreddy approved these changes Aug 4, 2025

View reviewed changes

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Aug 4, 2025

kcreddy reviewed Aug 4, 2025

View reviewed changes

packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json Show resolved Hide resolved

packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json Show resolved Hide resolved

Populate vulnerability.score.base from cvss.base_obj

dbc5ef1

kcreddy approved these changes Aug 6, 2025

View reviewed changes

brijesh-elastic merged commit c5252e5 into elastic:main Aug 6, 2025
9 checks passed

Conversation

brijesh-elastic commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related issues

Uh oh!

elasticmachine commented Aug 4, 2025

Uh oh!

brijesh-elastic Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maxcold Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod bot commented Aug 4, 2025

🚀 Benchmarks report

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

kcreddy Aug 4, 2025

Choose a reason for hiding this comment

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Aug 4, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented Aug 4, 2025

Quality Gate passed

Uh oh!

efd6 commented Aug 5, 2025

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Aug 6, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Aug 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

brijesh-elastic commented Aug 4, 2025 •

edited

Loading

brijesh-elastic Aug 4, 2025 •

edited

Loading