Is there a way to pass proxy credentials through the Qualys App for Splunk Enterprise?

[johnyDee]

Does anyone know if we can pass proxy credentials through the Qualys App for Splunk Enterprise? I have everything set per the documentation, but can't reach the API because of this.

[nit123]

Hi johnyDee,

Does my answer above solve your question ? If yes, spare a moment to accept the answer and vote for it. Thanks.

[nit123]

Do you mean to pass proxy credentials through Qualys TA for Splunk ? If yes, your question can be answered with following steps

1. Download Qualys TA for Splunk from https://splunkbase.splunk.com/app/2964/

It fetches Vulnerability Management (VM), Web Application Scanning (WAS) and KnowledgeBase (KB) data using modular input and indexes it which then can be searched using Qualys VM App for Splunk and/or Qualys WAS App for Splunk.

1. Once you have installed the TA on your splunk instance, go to Apps -> Manage apps . You see the TA listed as an application. Click on the setup link in the application row.

2. Add the API Server , user credentials, preferred detection settings and scroll down to the bottom of the page. You see a Proxy Configuration section. Enable checkbox for ' Use a proxy Server for Qualys API requests' and in the textbox below this checkbox add your proxy settings.

3. Format of the proxy should be as username:password@10.10.10.2:8080) if authorisation required. If no user exists for the proxy set as 10.10.10.2:8080 . Once done. save the form on setup page.

4. Restart your splunk instance and monitor logs at /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log. From the next run, it will use the proxy settings.