Splunk Search

Which API Access?

Heff
Splunk Employee
Splunk Employee

We are loading up the Qualsys forwarder and have been specifically asked about the api access and whether we need scanner, reader or manager ?

I’m leaning toward manager to give us legit access to api, but obviously want only as much as needed.

Thanks

0 Karma

tmccamant
Explorer

I would use a reader account, since you will only be pulling in the vulnerability information. Once the reader account has been created you will need to assign which asset groups you would like to pull into Splunk.

Qualys user definitions (https://qualysguard.qualys.com/qwebhelp/fo_help/user_accounts/users_user_role.htm)
- Manager. A Manager has full rights and access to all account resources, including all asset groups in the subscription. Managers have the same rights as the subscriber of the account, who was automatically assigned a Manager role.
- Scanner. A Scanner can launch maps and scans on assigned groups and generate reports based on the results.
- Reader. A Reader can view saved map and scan results for assigned groups and generate reports based on the results.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...