topic Re: Qualys Technology Add-on (TA) for Splunk: Why am I receiving "Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue." error? in Splunk Enterprise Security

Qualys Technology Add-on (TA) for Splunk: Why am I receiving "Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue." error?

amalkapuram — Thu, 27 Apr 2017 19:44:16 GMT

I have installed Qualys Technology Add-on (TA) for Splunk. Have set up the account details- username, password with API access, API service is enabled and working fine (as it is being used on some other platform).

Even after setting up everything- these logs are being displayed on Splunk:

sourcetype=qualys
Logs-
Start qualys TA
Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: 'str' object has no attribute 'os_startIndex'
Start qualys TA
Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: 'str' object has no attribute 'os_startIndex'
Start qualys TA
Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: 'str' object has no attribute 'os_startIndex'
Start qualys TA
Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: 'str' object has no attribute 'os_startIndex'
Start qualys TA
Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue. Error: 'str' object has no attribute 'os_startIndex'

Re: Qualys Technology Add-on (TA) for Splunk: Why am I receiving "Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue." error?

nit123 — Tue, 29 Sep 2020 14:34:46 GMT

Can you confirm the following

a. The version of Qualys Technology Add-on (TA) ?
b. If your SPLUNK_HOME is /opt/splunk, then from SPLUNK_HOME/etc/apps/TA-QualysCloudPlatform run following command - /opt/splunk/bin/splunk cmd python ./bin/run.py -h to check data pull operations for the config you have added.
c. Check if there are any API errors at /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log

Re: Qualys Technology Add-on (TA) for Splunk: Why am I receiving "Could not get TA-QualysCloudPlatform credentials from Splunk. Cannot continue." error?

becksyboy — Tue, 29 Sep 2020 14:40:54 GMT

Hi nit123,

i am also seeing this error when deploying the TA to a heavy forwarder. when running the command above i get the following below.

TA-QualysCloudPlatform: 2017-06-29T11:52:10Z PID=12702 [MainThread] INFO: TA-QualysCloudPlatform - Making request: https://qualysapi.qualys.com/msp/about.php with params={}
_internal

TA-QualysCloudPlatform: 2017-06-29T11:53:21Z PID=12702 [MainThread] ERROR: TA-QualysCloudPlatform - Error during request to /msp/about.php, [None] [Errno 110] Connection timed out
_internal
Traceback (most recent call last):
File "./bin/run.py", line 138, in
qapi.client.validate()
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 200, in validate
response = self.get("/msp/about.php", {}, SimpleAPIResponse())
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/lib/api/Client.py", line 259, in get
raise APIRequestError("Error during request to %s, [%s] %s" % (end_point, ue.errno, ue.reason))
qualysModule.lib.api.Client.APIRequestError: Error during request to /msp/about.php, [None] [Errno 110] Connection timed out

thanks
Ash