All Apps and Add-ons

Dashboard of "Qualys PC App for Splunk Enterprise" remains empty

rschutt
Explorer

It looks like no data for the "Policy Posture" is being fetched. The "WAS"- and "Host Detection"-inputs are working fine.

The Splunk-version is 6.5.2 and below are the events found in "ta_QualysCloudPlatform.log" that are related to this request (debug-mode is enabled). The setting with regards to "Policy Posture" are default.

TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19370 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19406 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Making request: https://qualysapi.qualys.eu/msp/about.php with params={}
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator started.
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/qualys_log_populator.py", line 544, in _run
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator finished.

Does anyone have the same experience or any idea how we can solve this?

Many thanks!

0 Karma
1 Solution

rschutt
Explorer

We were able to solve this problem. The problem was caused by the fact that the TA has been deployed from the Forwarder-Manager. This means that we were not able to configure the app from the UI. As a result of the update the TA the Policy-Posture-fetches were added but needed to be configured. So I created an additional stanza in the inputs.conf for the Policy-Posture but the only thing it did was contacting the "About"-page of Qualys.

When I installed the TA on a different stand-alone system and set it up properly I discovered that there were additional options in the qualys.conf-file. Although these are assigning empty values I copied these options to my production-environment and this works.

So the message is, always use the UI to set this up.

Thanks!

View solution in original post

0 Karma

rschutt
Explorer

We were able to solve this problem. The problem was caused by the fact that the TA has been deployed from the Forwarder-Manager. This means that we were not able to configure the app from the UI. As a result of the update the TA the Policy-Posture-fetches were added but needed to be configured. So I created an additional stanza in the inputs.conf for the Policy-Posture but the only thing it did was contacting the "About"-page of Qualys.

When I installed the TA on a different stand-alone system and set it up properly I discovered that there were additional options in the qualys.conf-file. Although these are assigning empty values I copied these options to my production-environment and this works.

So the message is, always use the UI to set this up.

Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...