Splunk TA_QualysCloudPlatform

[jadengoho]

Hi All ,
i am trying to insert Qualys data to the splunk but no luck at all.
I Install the Addon to the Heavy forwarder, and APP to search head .
tried to put all the credentials in addon setup ,
after a minute i got this :

6/11/18 3:56:34.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:34 PID=20341 [MainThread] INFO: TA-QualysCloudPlatform [host_detection] - ERROR: Time interval input 86400 is not valid.Using default time interval 1d.
host =hf2 source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =ta_QualysCloudPlatform-too_small


6/11/18 3:56:30.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:30 PID=20350 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - ERROR: Time interval input 86400 is not valid.Using default time interval 1d.
host =hf2 source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =    ta_QualysCloudPlatform-too_small


6/11/18 3:56:30.000 AM  
TA-QualysCloudPlatform: 2018-06-11 07:56:30 PID=20350 [MainThread] ERROR: TA-QualysCloudPlatform [was_findings] - could not load API response. Reason: API ERROR. Code=UNAUTHORIZED Message=You do not have access to module WAS required by this API.
host =hf2  source =/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log sourcetype =ta_QualysCloudPlatform-too_small

Could someone explain me why im encountering this ?And how to solve this .
i read that "You do not have access to module WAS required by this API" how can i enable it for me to got data?
Thanks in advance.

[prabhasgupte]

@jadengoho, you need to contact your Qualys technical account manager (TAM) to enable WAS Access, and possibly API access as well. That will solve your "UNAUTHORIZED" issue.

The Qualys TA recommends using cron format to have more control on your data input execution time. So, it would be better if you switch to that. It still supports the older way of w/d/h/m/s (weeks/days/hours/minutes/seconds), but that works differently. When using these older options, the TA will sleep for that many duration before running again. (and trust me, that is risky!)
For the duration field, you set 86400, which does not fit in either of old way or cron way, hence that error.

[jadengoho]

Hi prabhasgupte,
If 86400 is not the best fit , could you suggest what we should use ?