Is there a way of excluding non-running kernels in Qualys in Splunk?

[kiran331]

Hi

Is there a option to exclude non running kernels of Linux systems in Qualys metadata in Splunk, like it has option in Qualys reporting?

[prabhasgupte · Accepted solution]

You just need to set Extra API Parameter for Host Detection. Go to TA setup page, and in "VM Detection Settings" section, in "Extra parameters to pass to Detection API" field set either of active_kernels_only=1 or {"active_kernels_only": 1} and Save.

From the next run, it will pass that as additional API parameter. You can verify that with this search SPL: index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"

[kiran331]

I tried this one, It dint work

[kiran331]

This worked after I updated the add-on. Thanks!

[kernand0]

If you configured the app and missed the opportunity to specify additional API parameters you should be able to added them directly to the qualys.conf file. Assuming a default installation location add the line to the stanza in /opt/splunk/etc/apps/TA-QualysCloudPlatform/local/qualys.conf

[setupentity]
...
detection_params = active_kernels_only=1&any_other_supported_options

Again assuming a default install the other supported options are detailed around line 30 in the file:
/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/splunkpopulator/detectionpopulator.py

_validFilters = ['ips', 'compliance_enabled', 'no_vm_scan_since',
'vm_scan_since', 'id_min', 'id_max',
'ag_ids', 'ag_titles',
'os_pattern', 'show_igs', 'qids', 'severities',
'include_search_list_titles', 'exclude_search_list_titles',
'include_search_list_ids', 'exclude_search_list_ids',
'active_kernels_only', 'use_ags', 'tag_set_by', 'tag_include_selector',
'tag_exclude_selector', 'tag_set_include', 'tag_set_exclude', 'show_tags', 'network_ids',
'max_days_since_last_vm_scan', 'status',
'host', 'index'
]

Restart Splunk when you are done.
Note that some of those are NOT qualys API options. Hope that helps.