Automate Qualys Vulnerability Scans & Reports via Slack with n8n

1. Opening Problem Statement

Meet Alex, a cybersecurity analyst responsible for continuous vulnerability management at a mid-sized company. Every week, Alex spends multiple hours logging into the Qualys platform, manually triggering new vulnerability scans, and then generating detailed reports to share with the security team within Slack channels. This repetitive process is time-consuming, prone to mistakes like misconfiguring scan parameters or sharing outdated reports, and delays critical response times.

Before automation, Alex wasted approximately 4-5 hours weekly handling these manual tasks — hours that could be better spent analyzing threat data or planning mitigation strategies. Plus, every mistake risks leaving security gaps unnoticed. Alex needs a streamlined, foolproof way to run scans and publish reports rapidly and reliably without leaving Slack.

2. What This Automation Does

This n8n workflow integrates Slack and Qualys to enable straightforward Slack-driven vulnerability scanning and report generation through interactive modals. When triggered, it:

• Receives Slack shortcut interactions via webhook and parses payload data.
• Shows a modal popup in Slack to collect scan or report parameters like scan title, asset groups, report template, and output format.
• Routes user inputs dynamically based on interaction type (scan initiation or report generation).
• Triggers detailed sub-workflows to execute Qualys vulnerability scans or generate reports using provided inputs.
• Closes the Slack modal gracefully and acknowledges the command to maintain smooth UX.
• Posts back scan results or uploaded reports directly into configured Slack channels, streamlining communication.

By automating these steps, Alex can now launch scans and create reports in minutes instead of hours, consistently using accurate parameters and instantly sharing results—all without leaving Slack.

3. Prerequisites ⚙️

• n8n account (cloud or self-hosted)
• Slack app with API credentials configured for event subscriptions and modals 📧🔑
• Qualys API credentials for scanning and report generation 🔑
• Familiarity with Slack shortcut commands and modals

For self-host hosting options, consider platforms like Hostinger to run n8n privately.

4. Step-by-Step Guide

Step 1: Setup Slack Event Subscription Webhook Node

Navigate to your n8n editor and add a Webhook node configured with method POST. Set the path (e.g., 4f86c00d-ceb4-4890-84c5-850f8e5dec05) to listen for Slack interaction payloads from shortcut commands.

Visual cue: You will see incoming data points in the webhook once Slack sends interaction events.

Common mistake: Not correctly configuring Slack’s Event Subscription URL to match this webhook’s URL with the right path.

Step 2: Parse Slack Webhook Payload

Connect a Set node named “Parse Webhook” to extract the incoming Slack event’s payload into a more usable $json.body.payload structure. Assign it to a field called response.

This standardizes incoming data for downstream logic.

Step 3: Route Slack Messages Based on Interaction Type

Add a Switch node “Route Message” and define conditions on callback_id and type to distinguish between these Slack interactions:

• Vulnerability scan initiation (callback_id: trigger-qualys-vmscan)
• Scan report generation (callback_id: qualys-scan-report)
• Modal form submissions (type == view_submission)

This allows dynamic workflow branching.

Step 4: Respond Immediately to Slack Interactions

Depending on the route, add Respond to Webhook nodes with appropriate HTTP status codes (204 or 200) to acknowledge Slack and prevent timeout errors.

Step 5: Show Vulnerability Scan Modal in Slack

If a scan is requested, use an HTTP Request node “Vuln Scan Modal” to call Slack’s views.open API. Pass trigger_id from parsed payload and define modal blocks requesting:

• Option Title (text input)
• Scan Title (text input)
• Asset Groups (text input)

Slack users fill in this modal to configure the scan.

Step 6: Show Scan Report Modal in Slack

Similar to step 5, use another HTTP Request node “Scan Report Task Modal” for report generation input gathering: users select report template, title, and output format (PDF/HTML/CSV).

Step 7: Close Slack Modal and Route Submission

Once users submit either modal, use Respond to Webhook node “Close Modal Popup” to send HTTP 204 and then a Switch node “Route Submission” looks at the modal title text to determine which processing path to take.

Step 8: Prepare Variables for Scan or Report

Use Set nodes “Required Scan Variables” and “Required Report Variables” to extract modal inputs and append static values like Qualys API URL for use in the next steps.

Step 9: Execute Qualys Workflows

Trigger nested workflows using Execute Workflow nodes “Qualys Start Vulnerability Scan” or “Qualys Create Report”, passing all necessary parameters for the Qualys API to act upon. These sub-workflows handle authentication, API requests, and scan/report creation logic.

Step 10: Publish Results Back to Slack

Once Qualys workflows complete, results or reports are sent back to Slack channels for team review, keeping communication transparent and timely.

5. Customizations ✏️

• Change Slack Channels for Notifications: In the nested Qualys workflows, update Slack API node channel IDs to post scan results or reports to your preferred Slack team channels.
• Modify Scan Modal Inputs: Edit the Vuln Scan Modal HTTP request node to add or remove fields such as adding a severity filter or scan schedule option to fine-tune scan parameters.
• Support Additional Report Formats: Enhance the Scan Report Task Modal node with more output options (e.g., JSON or TXT) by updating the output_format select field choices.
• Use Custom Qualys API URLs: Adjust the static strings platformurl and base_url in the Set nodes to point to specific Qualys environments or regional APIs.

6. Troubleshooting 🔧

Problem: “Slack modal fails to open or shows invalid trigger_id”

Cause: The trigger_id expires in 3 seconds or is missing from the payload.

Solution: Ensure you call the Slack views.open API within 3 seconds of receiving the interaction event and correctly extract response.trigger_id from the webhook payload in the Parse Webhook node.

Problem: “API authentication errors with Qualys workflows”

Cause: Incorrect API credentials or expired tokens.

Solution: Verify and refresh API credentials configured in the Qualys sub-workflows. Test your connection independently inside n8n using test requests.

Problem: “Data from modal submissions not passed correctly to sub-workflows”

Cause: Incorrect field names or mismatch in referencing modal input data in Set nodes like Required Scan Variables.

Solution: Double-check JSON paths in Set nodes that extract values from response.view.state.values. Use the n8n debug panel to inspect incoming payload formats.

7. Pre-Production Checklist ✅

• Ensure Slack API credentials have necessary scopes including commands, chat:write, users:read, and views:write.
• Verify the Qualys API credentials are valid and allowed to initiate scans and generate reports through API.
• Test the Slack shortcut triggers in your Slack workspace to confirm modals appear as expected.
• Run subs workflows independently to validate Qualys scan and report generation steps.
• Check all node connections and variable mappings inside the workflow to prevent breaking data flow.

8. Deployment Guide

Activate your workflow in n8n by setting it live and keeping it running, ensuring the webhook URLs are exposed publicly so Slack can send events successfully. Monitor the n8n Execution History for any errors or failed runs.

Set up alerting or logging (via n8n or external tools) to catch failures early. Periodically audit Slack app credentials and Qualys API status to maintain reliability.

9. FAQs

Can I use a different vulnerability scanner tool instead of Qualys?

Yes, as long as you can create similar API integrations with that tool and adjust the sub-workflows accordingly, you can replace Qualys with scanners like Tenable or Rapid7.

Is the data transmitted between Slack, n8n, and Qualys secure?

All data uses HTTPS encrypted API connections. You should also ensure your n8n environment is secured, especially if self-hosting.

Can this setup scale for large enterprise environments?

Yes, but consider implementing rate-limiting, retry mechanisms, and possibly queuing if running many concurrent scans.

10. Conclusion

With this detailed n8n workflow, Alex and security teams gain powerful Slack-based controls to trigger Qualys vulnerability scans and generate professional reports effortlessly. This reduces manual efforts by hours weekly, eliminates repetitive context-switching, and improves the timeliness and accuracy of vulnerability management reporting.

Next, you might explore automations for automated remediation alerts, scheduled scan triggers, or integrating vulnerability data into centralized dashboards.

Let’s streamline your security operations to be faster, smarter, and more responsive—all from your Slack interface.