Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Re: ER: Qualys TA for Splunk to pull Activity Logs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ER: Qualys TA for Splunk to pull Activity Logs
Please add an input configuration that pulls the Activity Logs already parsed for the C.I.M Data models.
From the API documentation:
Activity Log
You can view the Activity Log using the Qualys user interface and the Activity Log API
(/api/2.0/fo/activity_log). The Activity Log shows details about user actions taken.
To view the Activity Log, log into your Qualys account. Go to Users and click the Activity
Log tab. Select Filters > Recent API Calls. You’ll see the API Processes list showing the API
calls subject to the API limits (all APIs except “session” API) made by subscription users
and/or updated by the service in the past week.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please refer the "Qualys Cloud Platform 8.10 (VM/PC) API Notification 2"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@guarisma As @lakshman239 suggested, please contact Qualys Support and open a Feature Request.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I assume you want the add-on to include activity logs. As the add-on is now owned by Qualys, if you have support account with them, please raise a request with them to include them in their TA.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, that's exactly what I want.
I was hoping this post reaching Qualys support or product, I guess I'll have to email them directly.
Thanks
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
