Qualys Security Operations via Slack Shortcut Bot - n8n Workflow

• Security Operations (SecOps) teams seeking to streamline vulnerability management.
• DevOps engineers needing quick access to scanning tools without leaving Slack.
• Organizations looking for robust n8n templates to bridge communication and security tools.
• Users interested in building complex integrations using the Slack API and n8n nodes.

Managing security scans and reports manually can be time-consuming. This specialized n8n workflow solves this by providing instant, authorized access to critical Qualys functions right inside Slack. By leveraging Slack shortcuts, users can instantly summon interactive modals (pop-up windows) to configure and launch a vulnerability scan or generate a detailed report from previous scan data. This n8n automation centralizes security tasks, ensuring faster response times and improved operational efficiency. Every component, from the initial n8n trigger webhook to the final execution of the Qualys operations via sub-workflows, is designed for reliability and speed, making this one of the most practical n8n templates for SecOps.

The entire process is initiated by a user interaction within Slack, serving as the primary n8n trigger.

1. Initial n8n Trigger: The workflow starts with the Webhook n8n node, which receives a POST request payload when a user interacts with a designated Slack shortcut (e.g., /qualys-scan).


2. Payload Parsing: The Parse Webhook n8n node standardizes the incoming Slack payload, making it easy for subsequent nodes to process the user's request details.


3. Route Initial Action: The Route Message n8n node determines the user's intent based on the callbackid. It routes the request to either display the 'Vulnerability Scan Modal' or the 'Scan Report Task Modal'.


4. Display Modals: Corresponding HTTP Request n8n nodes (Vuln Scan Modal or Scan Report Task Modal) call the Slack API to display interactive modals, prompting the user for necessary configuration variables (e.g., scan title, output format).


5. Acknowledge and Process Submission: Upon modal submission (viewsubmission type), the workflow first uses the Close Modal Popup n8n node to send a 204 response, ensuring a smooth user experience by immediately dismissing the modal.


6. Route Submission Type: The Route Submission n8n node checks the modal title (e.g., 'Vulnerability Scan' or 'Scan Report Generator') to correctly identify the required operation.


7. Set Variables: Depending on the route, dedicated Set n8n nodes (Required Scan Variables or Required Report Variables) extract the input values (e.g., asset groups, report template) from the Slack payload.


8. Execute Qualys Actions: Finally, the workflow uses Execute Workflow n8n nodes (Qualys Start Vulnerability Scan or Qualys Create Report) to pass the collected data to separate, specialized n8n workflows that handle the actual Qualys API interactions and Slack notifications.

To deploy this powerful n8n workflow, follow these steps:

1. Import: Copy the provided JSON data and import it into your n8n instance as a new workflow.


2. Webhook Setup: The initial Webhook n8n trigger node will generate a unique URL. Configure your Slack application's Event Subscriptions and/or Interactive Components/Shortcuts to send requests to this URL.


3. Credential Configuration: Update all HTTP Request n8n node credentials. Ensure you link a valid Slack API token (usually a Bot Token with appropriate permissions, such as views:open). The sticky note reminds you that n8n simplifies this process.


4. Qualys Sub-Workflows: This main workflow relies on two sub-workflows (Qualys Start Vulnerability Scan and Qualys Create Report). You must import these corresponding n8n templates (if not already done) and update the Execute Workflow n8n nodes with their correct IDs.


5. Sub-Workflow Channels: As noted in the sticky notes, ensure that the Slack channels specified in the sub-workflows (where the scan results or reports will be posted) are correctly configured.


6. Activate: Set the n8n workflow to 'Active' to start listening for Slack triggers.

This complex n8n workflow relies on core flow control nodes and API interaction mechanisms:

Webhook (n8n Trigger): The entry point of this n8n workflow. It is configured to listen for POST requests from the Slack API, initiating the automated response.
Parse Webhook (Set n8n Node): Extracts and normalizes the complex Slack webhook payload into an easily accessible JSON object named response.
Route Message & Route Submission (Switch n8n Nodes): These critical n8n node instances provide logic and flow control. They analyze the incoming Slack data (callback_id or modal title) to dynamically route the automation path, ensuring the correct modal or action is triggered.
Respond to Webhook (n8n Node): Used multiple times (Close Modal Popup, Respond to Slack Webhook - Vulnerability, etc.) to send immediate 200 or 204 status codes back to Slack, fulfilling the requirements for timely Slack API acknowledgments.
Vuln Scan Modal / Scan Report Task Modal (HTTP Request n8n Node): These n8n nodes construct and send complex JSON payloads to https://slack.com/api/views.open. This dynamically generates and displays the input forms (Modals) inside the Slack user interface, utilizing predefined Slack API authentication credentials.
Required Variables (Set n8n Nodes): These n8n node instances capture user input (e.g., scan titles, report format: PDF/HTML/CSV) extracted from the modal submission data and format it into variables for the subsequent Qualys sub-workflows.

• Qualys Execute Workflow (n8n Node): Crucial for modularity, this n8n node delegates the heavy lifting (Qualys API calls for scanning and reporting) to separate, specialized n8n templates/workflows, making this primary n8n workflow cleaner and easier to maintain.