Automatically move new Qualys vulnerability reports into TheHive

Every hour, this checks for new Qualys reports and automatically opens a case for each one in TheHive.

How the work actually flows

It repeats. Repeats hourly recheck for reports; runs once per each new report.

Pattern: Structured Loop (21) ยท Multiple Instances without Synchronization (12)

flowchart TD trig(["hourly check for new reports"]):::trigtime s0["filter out processed reports"]:::task s1[["create case in TheHive"]]:::mi s2["attach report file to case"]:::task trig --> s0 s0 -->|"one per each new report"| s1 s1 --> s2 lp{"runs every hour"}:::gate s2 --> lp lp -. "hourly recheck for reports" .-> s0 lp -->|"finished"| out out[/"a TheHive case per report"/]:::out pay{{"no vulnerability report missed"}}:::pay out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff
Starts itA stepRuns once per itemRepeat or finishResultPayoff
Build size
Advanced

A larger build with multiple systems, AI reasoning, and custom rules.

Business functions
Knowledge Base & RAGReporting & AnalyticsSecurity & Compliance
Connects
QualysTheHive

The problem it solves

Your security team can't afford to miss a new vulnerability report sitting in Qualys, but checking for them by hand and manually opening a case takes time nobody has. Reports pile up between checks and gaps in tracking creep in.

Who it fits

Best for security operations teams that need every new Qualys report turned into a tracked case without delay.

How it works

  1. Every hour, the system checks Qualys for newly finished reports
  2. It filters out any reports that were already processed
  3. For each new report, a case is created in TheHive
  4. The report file is downloaded and attached to that case automatically
What you get

Vulnerabilities tracked the moment they're found

You get every new Qualys vulnerability report automatically turned into a tracked case in TheHive, so nothing slips through unnoticed.

What you get

A new TheHive case for every fresh Qualys report, with the full report attached and ready for review.

What you need

A Qualys account and a TheHive instance with API access.

We can build this. But should you?

The hard question is not how to build it. It is whether this is the right thing to build first.

That is what a Fractional Chief AI Officer figures out with you, before anyone writes a line of code.

Let's Talk Strategy

Related automations

Automatically flag privacy risks and generate compliance reports

AI reviews data usage events for privacy risk, alerts your team, and logs the findings for audits.

Advanced

Launch vulnerability scans and reports from Slack

A Slack shortcut lets your team start a Qualys vulnerability scan or pull a report without leaving the chat.

Standard

Launch and track a vulnerability scan from a Slack message

Kick off a security scan from Slack and get the results posted back automatically when it's done.

Advanced

Monitor intellectual property conflicts and alert your legal team

Scans for intellectual property conflicts and alerts your team by severity, from a Slack note to an urgent email.

Advanced
Back to the AI Playbook