In our current environment, we can only allow external API access from one of our forwarders. The idea is to install the Qualys Technology Add-on (TA) for Splunk (TA-QualysCloudPlatform) with a custom TA-QualysCloudPlatform_inputs_app on the forwarder with knowledge_base and host_detection inputs. The data will be indexed into our Indexer cluster and would be searchable via our Enterprise security search head cluster.
We would not be installing the Qualys VM app on the search heads, but would create custom searches. Will the qualys_kb.csv be automatically updated via the knowledge_base input on the forwarder? If we want to utilize the lookups/lookup definitions from the search head, how best can we achieve this? Do we still need to add a copy of our TA-QualysCloudPlatform app to all the search heads?
thanks
I hope you have clustered SH and Indexers? Do you have heavy Forwarders?
I hope you have clustered SH and Indexers? Do you have heavy Forwarders?