Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- ER: Qualys TA for Splunk to pull Activity Logs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ER: Qualys TA for Splunk to pull Activity Logs
Please add an input configuration that pulls the Activity Logs already parsed for the C.I.M Data models.
From the API documentation:
Activity Log
You can view the Activity Log using the Qualys user interface and the Activity Log API
(/api/2.0/fo/activity_log). The Activity Log shows details about user actions taken.
To view the Activity Log, log into your Qualys account. Go to Users and click the Activity
Log tab. Select Filters > Recent API Calls. You’ll see the API Processes list showing the API
calls subject to the API limits (all APIs except “session” API) made by subscription users
and/or updated by the service in the past week.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please refer the "Qualys Cloud Platform 8.10 (VM/PC) API Notification 2"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@guarisma As @lakshman239 suggested, please contact Qualys Support and open a Feature Request.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I assume you want the add-on to include activity logs. As the add-on is now owned by Qualys, if you have support account with them, please raise a request with them to include them in their TA.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, that's exactly what I want.
I was hoping this post reaching Qualys support or product, I guess I'll have to email them directly.
Thanks
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
