Can I use ASC Workflow automation to install Qualys agent?

[Jeff Walzer]

We have the following recommendation in ASC - Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys) (Preview) - that has some VMs that need the agent.

Within the recommendation I can remediate, but is there anyway to use Workflow automation to look for VMs that do not have the Qualys agent and to install it?

I tried creating a Logic app and copied and pasted the remediation logic from the recommendation, but it did not work.

Thx 

[#2 · Accepted solution]

Yes.  i just created a working sample here

https://github.com/Azure/Azure-Security-Center/tree/master/Workflow%20automation/Install-VulnAssesme...

[#3]

@Nicholas DiCola (SECURITY JEDI) 

Thx a million - I just tried to deploy the playbook and got the following error:

[#4]

whoops forgot the dependson. in the resource.

just fixed the template.

[#5]

@Nicholas DiCola (SECURITY JEDI) 

Thx again Nick - for my edification, the workflow will kick in when it sees an unhealthy resource in the Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys) (Preview) recommendation, correct?

We have some VMs that are powered off so I am assuming when they get powered on, the workflow will run to install the Qualys agent.

And last question, can you point me to some documentation about ASC workflow?

TYVM

[#6]

@Jeff Walzer 

yes but you need to create the workflow automation like this

 here is the docs page https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

[#7]

@Nicholas DiCola (SECURITY JEDI)

Perfect as that's how I configured it,

Thx for the link 

[#8]

@Nicholas DiCola (SECURITY JEDI

Sorry to be a pain, but I ran into an error as I turned on a VM and then checked the logic app and saw that it failed

 

{

  "error": {

    "code": "AuthenticationFailed",

    "message": "Authentication failed. The 'Authorization' header is missing."

  }

}

[#9]

@Jeff Walzer 

the template creates two api connection resources. you have to authorize them.  go to the resource.  click edit api connection.  click authorize.  login in the new window.  click save.

[#10]

@Nicholas DiCola (SECURITY JEDI)

API now authorized and when I do a 'Run Trigger' I get the following error message:

InvalidTemplate. Unable to process template language expressions in action 'Create_or_update_a_template_deployment' inputs at line '1' and column '3277': 'The template language function 'split' expects its first parameter to be of type string. The provided value is of type 'Null'. Please see https://aka.ms/logicexpressions#split for usage details.'.

[#11]

@Jeff Walzer 

you cant just run trigger from logic apps as no data is passed to the ASC trigger step.

go to the recommendation in ASC and click run playbook.  that will push the recommendation data to the trigger.

[#12]

@Nicholas DiCola (SECURITY JEDI) - thx as it's working now. Appreciate all the help!

[#13]

@Nicholas DiCola (SECURITY JEDI) 

Hi Nicholas, thanks for super usefull logic app. 

I made the setup you have described, I used automation workflow for ASC recommendation (A vulnerability assessment solution should be enabled on your virtual machines) with logic app to create ARM deployment. And it works well when I trigger Logic App from ASC (Azure Portal) but the automation workflow does not trigger my logic app at all. Is it possible that when the recommendation exist with many VM's in state not-applicable and unhealthy then any new VM which appear with unhealthy state will not trigger automation ? because the recommendation exist ? In short for existing recommendation new resource won't trigger the workflow automation ? 

Thanks in advance for any insides ... 

Br, Kris