topic Re: Is there a way of excluding non-running kernels in Qualys in Splunk? in All Apps and Add-ons

Is there a way of excluding non-running kernels in Qualys in Splunk?

kiran331 — Thu, 01 Dec 2016 17:41:18 GMT

Is there a option to exclude non running kernels of Linux systems in Qualys metadata in Splunk, like it has option in Qualys reporting?

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

kernand0 — Tue, 29 Sep 2020 12:54:59 GMT

If you configured the app and missed the opportunity to specify additional API parameters you should be able to added them directly to the qualys.conf file. Assuming a default installation location add the line to the stanza in /opt/splunk/etc/apps/TA-QualysCloudPlatform/local/qualys.conf

[setupentity]
...
detection_params = active_kernels_only=1&any_other_supported_options

Again assuming a default install the other supported options are detailed around line 30 in the file:
/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/splunkpopulator/detectionpopulator.py

_validFilters = ['ips', 'compliance_enabled', 'no_vm_scan_since',
'vm_scan_since', 'id_min', 'id_max',
'ag_ids', 'ag_titles',
'os_pattern', 'show_igs', 'qids', 'severities',
'include_search_list_titles', 'exclude_search_list_titles',
'include_search_list_ids', 'exclude_search_list_ids',
'active_kernels_only', 'use_ags', 'tag_set_by', 'tag_include_selector',
'tag_exclude_selector', 'tag_set_include', 'tag_set_exclude', 'show_tags', 'network_ids',
'max_days_since_last_vm_scan', 'status',
'host', 'index'
]

Restart Splunk when you are done.
Note that some of those are NOT qualys API options. Hope that helps.

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

prabhasgupte — Thu, 09 Mar 2017 06:32:20 GMT

You just need to set Extra API Parameter for Host Detection. Go to TA setup page, and in "VM Detection Settings" section, in "Extra parameters to pass to Detection API" field set either of active_kernels_only=1 or {"active_kernels_only": 1} and Save.

From the next run, it will pass that as additional API parameter. You can verify that with this search SPL: index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

kiran331 — Thu, 16 Mar 2017 20:15:02 GMT

I tried this one, It dint work

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

kiran331 — Fri, 24 Mar 2017 14:26:56 GMT

This worked after I updated the add-on. Thanks!