All Apps and Add-ons

Qualys VM App for Splunk Enterprise: Why are the dashboards searching on event types that are not defined anywhere in the app?

responsys_cm
Builder

I installed the latest release of the Qualys App (the one officially supported by Qualys) and the TA for it.

It would seem that all of the dashboards are driven off of event types that aren't defined anywhere in the app.

The IP lookup dashboard wants to search on eventtype=qualys_vm_detection_event.

The main dashboard and the Hosts dashboard want to search on eventtype=qualys_host_summary_event.

The Qualys Vulnerability Scan searches on source=qualys, but the app uses the path to the script name for pulling in scan results.

This app is completely broken. Does anyone know what the right event types are for this app?

0 Karma

jleggett
Explorer

it is not broken, it works perfectly fine. The event types are all defined in the TA, not the VM App. Please make sure you are using this TA:

https://splunkbase.splunk.com/app/2964/

Did you set up the TA according to the instructions? Are you seeing events from the TA loaded? (sourcetype=qualys:hostdetection)?

Did you previously have the older APp installed (the 1.2.2)? If so, you needed to completely remove that from your Splunk search head first for the new to work properly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...