All Apps and Add-ons
Highlighted

Is there a way of excluding non-running kernels in Qualys in Splunk?

Builder

Hi

Is there a option to exclude non running kernels of Linux systems in Qualys metadata in Splunk, like it has option in Qualys reporting?

0 Karma
Highlighted

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

New Member

If you configured the app and missed the opportunity to specify additional API parameters you should be able to added them directly to the qualys.conf file. Assuming a default installation location add the line to the stanza in /opt/splunk/etc/apps/TA-QualysCloudPlatform/local/qualys.conf

[setupentity]
...
detectionparams = activekernelsonly=1&anyothersupportedoptions

Again assuming a default install the other supported options are detailed around line 30 in the file:
/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/splunkpopulator/detectionpopulator.py

validFilters = ['ips', 'complianceenabled', 'novmscansince',
'vm
scansince', 'idmin', 'idmax',
'ag
ids', 'agtitles',
'os
pattern', 'showigs', 'qids', 'severities',
'include
searchlisttitles', 'excludesearchlisttitles',
'include
searchlistids', 'excludesearchlistids',
'active
kernelsonly', 'useags', 'tagsetby', 'tagincludeselector',
'tagexcludeselector', 'tagsetinclude', 'tagsetexclude', 'showtags', 'networkids',
'maxdayssincelastvm_scan', 'status',
'host', 'index'
]

Restart Splunk when you are done.
Note that some of those are NOT qualys API options. Hope that helps.

0 Karma
Highlighted

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

Communicator

You just need to set Extra API Parameter for Host Detection. Go to TA setup page, and in "VM Detection Settings" section, in "Extra parameters to pass to Detection API" field set either of active_kernels_only=1 or {"active_kernels_only": 1} and Save.

From the next run, it will pass that as additional API parameter. You can verify that with this search SPL: index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"

View solution in original post

Highlighted

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

Builder

I tried this one, It dint work

0 Karma
Highlighted

Re: Is there a way of excluding non-running kernels in Qualys in Splunk?

Builder

This worked after I updated the add-on. Thanks!

0 Karma