Hello All, We are facing issues with our Qualys Technology Add-on (TA) 1.5.1 where it is unable to fetch any data ( host detection/knowledge base ) from Cloud api. ta_QualysCloudPlatform.log: TA-QualysCloudPlatform: 2019-09-17 06:16:11 PID=18177 [MainThread] INFO: TA-QualysCloudPlatform (knowledge_base) - Making request: https://certs.qualys.eu/msp/about.php with params={} TA-QualysCloudPlatform: 2019-09-17 06:21:11 PID=18177 [MainThread] INFO: TA-QualysCloudPlatform (knowledge_base) - Making request: https://certs.qualys.eu/msp/about.php with params={} splunkd.log: 09-17-2019 06:26:12.124 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualys.py" INFO:TA-QualysCloudPlatform (knowledge_base):Making request: https://certs.qualys.eu/msp/about.php with params={} 09-17-2019 06:31:12.156 +0200 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualys.py" INFO:TA-QualysCloudPlatform (knowledge_base):Making request: https://certs.qualys.eu/msp/about.php with params={} Configuration: Qualys TA has been installed in both Search head and heavy forwarder as per the Qualys guidelines Host_dection input has been enabled in HF and KB input enabled in SH Configuration on SH: inputs.conf [qualys://knowledge_base] duration = */5 * * * * index = main start_date = 1999-01-01T00:00:00Z disabled = 0 qualys.conf [setupentity] api_server = https://certs.qualys.eu ca_key = /opt/splunk/etc/auth/qualys/client_key.key ca_path = /opt/splunk/etc/auth/qualys/client_cert.cert ca_pass = password ( hashed out in passwords.conf ) username = username ( hashed out in passwords.conf ) password = password ( hashed out in passwords.conf ) cs_log_container_summary_events = 0 cs_log_individual_container_events = 0 cs_log_individual_events = 0 cs_log_summary_events = 0 cs_multi_threading_enabled = 0 enable_debug = 1 enable_full_pull = 0 log_detections = 0 log_extra_host_summary = 0 log_host_details_in_detections = 0 log_host_summary = 0 log_individual_compliance_events = 0 log_policy_summary = 0 proxy_server = proxy_server_ip:port use_ca = 1 use_multi_threading = 0 use_multi_threading_for_was = 0 use_proxy = 1 The api pull works when done via curl command using the same certificate/credentials and proxy from the same server just not happening from qualys add-on. Any suggestions will be appreciated ... View more

Hello Andrew @landen99 First of all a big thanks for coming up with this great app concept. I would love to leverage it to do some splunk internal configuration monitoring and management. I have got started with the app and gone thought the readme file. Once I downloaded the main app I found it has multiple sub directories. I have understood their functions but unable to kick start them to do their job. ca_idx --> has been copied to indexer which created the required indexes --> working fine ca_win/default --> has been configured to onboard logs windows/linux --> works fine But ca_sh,ca_btool,ca_tool is where I am stuck. Are they supposed to reside within the parent app config_analytics in the search head or should i put them independently under etc/apps folder in the search head ? Even though the data is correctly coming in , I am unable to leverage any of the dashboard functionality since these 3 sub apps seems to be broken. Any help would be highly appreciated. Finally thank you Gregg @woodcock for highlighting this app in .conf18. ... View more

Hello, I have been working with o365 reporting addon to extract email trace logs. This works fine but it misses out on one vital bit of information and that is the email attachment name/extensions. Seeking you help to configure splunk to able to pull this information over rest api from o365. There are answers which points to usage of python script to make this possible , but would appreciate if a bit more clarity is given on that Addon being used: TA-MS_O365_Reporting Regards Sayanta B ... View more

Hello, I wanted to reach out to you for assistance on Splunk ES threat_intel searches. Objective: We have endpoint security logs coming on to our Splunk with file hash values. We want these hash values to match against our threat intel feeds(local/downloaded) and flag them as part ThreatActivityDetected search Action taken: We have picked up some of the most noisy hash values and updated them in the local threat file_intel CSV in order test for a positive match. Observation: Our threat logs are getting fed into the malware datamodel and "local threat file_intel" holds the hash we uploaded manually. But, we do not see these matching as part of the threat intelligence datamodel. We assumed the threat collect search would pick up any matching hash(with the threat intel data) in search data, but it did not. Note: We do see the matching data as part of below sample search which is CIM complaint =====> |datamodel Malware Malware_Attacks search | `file_intel` | search file_hash = our hash value but somehow threat intel is unable to capture it and flag it. Is there any threat collect search i need to edit? Any leads on solving this would be appreciated. Regards ... View more