Qualys Javascript Data Feed Failure with the Error "The script execution failed due to an unexpected error"

[Kb-Sync]

Applies To

Product(s): Archer
Version(s): All Versions
Primary Deployment: On Premises/AWS Hosted/AWS SaaS

---

Description

Qualys Vulnerability Management Javascript data feed is failing with the below error:
The script execution failed due to an unexpected error

Cause

In order to determine the cause, the Javascript can be tested with Visual Studio Code. The below errors should be observed:
Error 1

023-09-08 11:23:41 :: ERROR :: INVALID HTTP ERROR CODE RETURNED : 403
ERROR HEADERS: {"User-Agent":"RSA ARCHER DATAFEED CLIENT","X-Requested-With":"RSA ARCHER DATAFEED CLIENT","Authorization":"Basic cGF5ZnU2YW46SVVucDVtSC8="}
ERROR BODY:  <?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "https://xxxxxxxxxxx/api/2.0/simple_return.dtd">;
<SIMPLE_RETURN>
<RESPONSE>
<DATETIME>2023-09-08T16:23:41Z</DATETIME>
<CODE>2002</CODE>
<TEXT>This account is inactive.</TEXT>
</RESPONSE>
</SIMPLE_RETURN>

2023-09-19 15:35:37 :: ERROR  :: INVALID HTTP ERROR CODE RETURNED : 401
ERROR HEADERS: {"User-Agent":"RSA ARCHER DATAFEED CLIENT","X-Requested-With":"MyQualysIntegration","Authorization":"Basic cGF5ZnU2YW4xOkxySXc3dUoB"}
ERROR BODY:  <?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE SIMPLE_RETURN SYSTEM "https://xxxxxxxxxxxx/api/2.0/simple_return.dtd">
<SIMPLE_RETURN>
<RESPONSE>
<DATETIME>2023-09-19T20:35:37Z</DATETIME>
<CODE>2000</CODE>
<TEXT>Bad Login/Password</TEXT>
</RESPONSE>
</SIMPLE_RETURN>\

The above errors indicate that the password is in an incorrect format (it contained a Forward slash / and/or a Backslash \). This is the password that is entered in the Custom Parameters section under the Source Connection tab of the Manage Data Feeds page.
Also, it is confirmed that the account is active.

Error 2

<DATETIME>2023-09-21T19:40:06Z</DATETIME>
<CODE>1905</CODE>
<TEXT>parameter status has invalid value: Active,New,Fixed,ReOpened (please specify a comma-separated list of 1 or more of the following (without duplicates): New, Active, Re-Opened, Fixed)</TEXT>
</RESPONSE>
</SIMPLE_RETURN>

The above error is due to that the detectionUrl which is under the Custom Parameters section is incorrect. In the above error, the detectionUrl used was as follows:
https://<platform API server>/api/2.0/fo/asset/host/vm/detection/?action=list&status=Active,New,Fixed,ReOpened&vm_scan_since=<LastRunTime>

Whereas, the correct detectionUrl should be as follows:
https://<platform API server>/api/2.0/fo/asset/host/vm/detection/?action=list&status=Active,New,Fixed,Re-Opened&vm_scan_since=<LastRunTime>

Note:

• The above mentioned detectionUrl is related to certain Qualys Vulnerability Management Data Feeds and NOT related to all Qualys Data Feeds. Each Qualys Data Feed has its own specific URL found in the Qualys documentation.
• Check the Qualys Vulnerability Management documentation for the specific details of the setup and configuration of each of the Qualys Data Feeds: https://help.archerirm.cloud/exchange/content/exchange/integrations/qualys_vuln_management.htm.

Resolution

Apply the below:

1. Reset the password and remove any Forward Slashes or Back Slashes. Then enter the correct new password in the Custom Parameters section in the Data Feed configuration.
2. Adjust the detectionUrl in the Custom Parameters section to the correct URL according to the Qualys Vulnerability Management documentation.