Qualys Technology Add-on (TA) for Splunk: Can the qualys_kb_lookup and qualys_severity_lookup be searchable if the add-on is only installed on one forwarder?

[becksyboy]

In our current environment, we can only allow external API access from one of our forwarders. The idea is to install the Qualys Technology Add-on (TA) for Splunk (TA-QualysCloudPlatform) with a custom TA-QualysCloudPlatform_inputs_app on the forwarder with knowledge_base and host_detection inputs. The data will be indexed into our Indexer cluster and would be searchable via our Enterprise security search head cluster.

We would not be installing the Qualys VM app on the search heads, but would create custom searches. Will the qualys_kb.csv be automatically updated via the knowledge_base input on the forwarder? If we want to utilize the lookups/lookup definitions from the search head, how best can we achieve this? Do we still need to add a copy of our TA-QualysCloudPlatform app to all the search heads?

thanks

[koshyk · Accepted solution]

I hope you have clustered SH and Indexers? Do you have heavy Forwarders?

• TA-QualysCloudPlatform should be installed on Search Heads, (indexers) & Heavy forwarders (optional)
• the TA should be in the SH, so it will contain lookups etc. This TA is the heart of your indextime and SEarch time extractions, so without it the fields will be missing
• If you want to collect the data via heavy-forwarder , you still need to have the TA in heavy forwarders. In your local, you can create a new inputs.conf and put your own "index" etc if you follow index naming standards in your organisation