Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About prabhasgupte
prabhasgupte
Communicator
Member since:
04-30-2015
06-05-2020
Community Statistics
| Posts | 47 |
| Solutions | 5 |
| Karma Given | 6 |
| Karma Received | 7 |
| Member Since | 04-30-2015 |
Activity Feed
- Karma Re: How to parse RESULTS field from Qualys TA for jamesco. 06-05-2020 12:50 AM
- Karma Re: ERROR ExecProcessor - message from "python /apps/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualys.py" for jeffriesa. 06-05-2020 12:48 AM
- Got Karma for Re: IS there way to pull extra information from Qualys like asset Tags, Groups?. 06-05-2020 12:48 AM
- Got Karma for Re: Qualys Technology Add-on (TA) for Splunk: Are these errors related to lack of API calls to Qualys or add-on configuration?. 06-05-2020 12:48 AM
- Got Karma for Re: API State, High Availability and SH Clustering using the Qualys app(s) and add-on for Splunk. 06-05-2020 12:48 AM
- Got Karma for Re: Qualys VM App for Splunk Enterprise: When will the app be compatible with Splunk 6.5.1?. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way of excluding non-running kernels in Qualys in Splunk?. 06-05-2020 12:48 AM
- Karma Is KVStore supported in search head clustering? for cparid. 06-05-2020 12:47 AM
- Karma Re: Is KVStore supported in search head clustering? for masonmorales. 06-05-2020 12:47 AM
- Got Karma for Why Splunk Common Information Model does not show data in pivot and tags aren't applied, but 'Search & Reporting' does?. 06-05-2020 12:47 AM
- Got Karma for Is there any way to verify CIM compliance of an app being developed?. 06-05-2020 12:47 AM
- Karma Re: Unable to initialize modular input "jmx" defined inside the app "jmx_ta" for samhughe. 06-05-2020 12:46 AM
- Karma Eventtype 'url-event' does not exist or is disabled for rshorter. 06-05-2020 12:46 AM
- Posted Re: Purging dead host data on All Apps and Add-ons. 09-17-2019 03:08 AM
- Posted Re: Use of multiple API and users? on All Apps and Add-ons. 08-07-2019 03:26 AM
- Posted Re: ER: Qualys TA for Splunk to pull Activity Logs on Splunk Enterprise Security. 08-07-2019 03:22 AM
- Posted Re: Can not hash proxy password in Qualys TA using GUI on All Apps and Add-ons. 08-07-2019 03:19 AM
- Posted Re: Splunk TA Qualys: many vulnerability informations are missing in Splunk on All Apps and Add-ons. 08-07-2019 02:15 AM
- Posted Re: Splunk TA_QualysCloudPlatform on All Apps and Add-ons. 06-11-2018 03:52 AM
- Posted Re: Qualys Technology Add-on (TA) 1.3.1 Data inputs issue on All Apps and Add-ons. 05-31-2018 03:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
09-17-2019
03:08 AM
Hi @bdpummer,
The Qualys TA does not support data deletion. However, if you know the purged host ids, you can use Splunk's delete command. It will stop those records from appearing in subsequent searches. But be aware that, the delete command does not reclaim the disk space.
... View more
08-07-2019
03:26 AM
Hi @derjosh ,
Single installation of Qualys TA does not support multiple Qualys accounts (at this moment). That's mainly because the TA setup page can handle only one pair of credentials for now.
However, if you are comfortable with Splunk distributed setup, you can have multiple forwarders having Qualys TA on each of them. Then, configure your different Qualys accounts on each of them and set them to forward data to single indexer.
... View more
08-07-2019
03:22 AM
@guarisma As @lakshman239 suggested, please contact Qualys Support and open a Feature Request.
... View more
08-07-2019
03:19 AM
Hi @cwvos ,
Can you please confirm which Qualys TA version you are using?
... View more
08-07-2019
02:15 AM
Hi @lauraG85
Those are not really the issues. Its by design. The API used in Qualys TA for VM detection returns normalized data across all scans. And hence, it does not contain any scan reference. Its more like a snapshot of your vuln posture at the point of API call. On similar lines, WAS API too does not have scan reference. Perhaps, opening a Feature Request on these two APIs with Qualys could be the next step.
For any data input, the TA does not parse each and every field from API response by default. It has a default set of fields to be parsed though. If you can read Python code, you can go to any of the populator class and see _process_root_element method.
For knowledge base, the TA does not parse "Solution" information, mainly because it could be multi-line. Similarly, it is not coded to parse "Exploitability" by default. If you need those fields, please get in touch with Qualys Support and they will guide you on how to customize that code to get "Solution" and "Exploitability" fields.
... View more
06-11-2018
03:52 AM
@jadengoho, you need to contact your Qualys technical account manager (TAM) to enable WAS Access, and possibly API access as well. That will solve your "UNAUTHORIZED" issue.
The Qualys TA recommends using cron format to have more control on your data input execution time. So, it would be better if you switch to that. It still supports the older way of w/d/h/m/s (weeks/days/hours/minutes/seconds), but that works differently. When using these older options, the TA will sleep for that many duration before running again. (and trust me, that is risky!)
For the duration field, you set 86400, which does not fit in either of old way or cron way, hence that error.
... View more
05-31-2018
03:22 AM
Hi @AlexeySh, do you see any errors in splunkd.log regarding this? If yes, can you post them here?
... View more
09-07-2017
04:41 AM
Can this be of any help to you? Replace the CVE with input token or change it to whichever you are searching for.
eventtype="qualys_vm_detection_event" cve=*CVE-2016-5554* | dedup 1 HOST_ID, QID | table HOST_ID, IP, QID, cve
Change the query as per your need.
... View more
08-30-2017
05:48 AM
I assume that you are using TA 1.2.2+
To get the RESULTS field indexed in host detection input, do the followings:
On TA Setup page, in VM Detection extra parameters, set show_results=0
Open bin/qualysModule/splunkpopulator/detectionpopulator.py and find class HostDetectionPopulator.
In this class, find _process_root_element(self, elem) method.
In that method, we have a list named HostDetectionPopulator.detection_fields_to_log. Its a list of fields to parse from detection tag. If you don't find it, you can copy one from the top of the same class.
In that list, add "RESULTS" at the end. As a best practice, add a comment describing why you edited this list. This will tell code to parse that XML tag as well and output it while printing the event data.
Save the file and restart your Splunk.
Let me draw your attention to the fact that, RESULTS in host detection API output could be multi-line text. As KV_MODE is set to auto for hostDetection input in props.conf, we are not sure how Splunk will treat the events when RESULTS field is multi-line text. It may or may not consider the multi-line text to be the part of same single event. The newline character might confuse Splunk's event detection.
... View more
06-13-2017
02:59 AM
No, currently there is no option available to achieve that.
I pressume you are using host detection data input. Qualys TA uses /api/2.0/fo/asset/host/vm/detection/ API to bring in the detection data. I referred this API User Guide, but I could not find any parameter named show_ags for above mentioned API.
In TA logs you might have got an entry saying show_ags is unsupported parameter. (or something similar).
Also, there is no other parameter available with this API which would pull the AG information. So, that can't be done currently.
... View more
03-22-2017
11:03 PM
@kiran331, have you tried this one?
... View more
03-22-2017
11:01 PM
You should be able to see tags in HOSTSUMMARY events (eventtype=qualys_host_summary_event). Tags would be in comma-separated string. Can you add extraction for that on your own?
... View more
03-22-2017
05:19 AM
Never mind! Got it working!!
I needed to add and import eggs for python_dateutil and six - as dependencies for croniter.
... View more
03-22-2017
03:09 AM
I want to accept data input interval as cron entry and process it in my modular input.
I am referring this REST API Modular Input app (https://splunkbase.splunk.com/app/1546/) for that. It uses croniter to get next run time of job.
However, I am not being able to import croniter into my modular input script.
I have croniter egg file at SPLUNK_HOME/etc/apps/TA-myta/bin/croniter-0.3.8-py2.7.egg
I have also explicitly added SPLUNK_HOME/etc/apps/TA-myta/bin/croniter-0.3.8-py2.7.egg to sys.path (not needed, but added as an attempt to make it work.)
However, when I try to import croniter, I get ImportError.
How can I fix this?
My code to the point of failure looks as follows. I always get into except block and never see "ready to go":
import sys
from datetime import datetime
import splunk.clilib.cli_common as scc
import splunk.entity as entity
logger = logging.getLogger('TA-myta')
TA_ROOT = os.path.dirname(os.path.dirname(os.path.realpath(__file__)))
egg_dir = TA_ROOT + "/bin/croniter-0.3.8-py2.7.egg"
sys.path.append(egg_dir)
try:
from croniter import croniter
except:
logger.error("could not import croniter. Exiting.")
exit(0)
logger.info("ready to go")
Edit 1:
The splunkd.log has following lines:
03-22-2017 16:27:30.105 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" ImportError: No module named dateutil.relativedelta
03-22-2017 16:28:30.264 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" Traceback (most recent call last):
03-22-2017 16:28:30.264 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" File "/opt/splunk/etc/apps/TA-myta/bin/myta.py", line 39, in <module>
03-22-2017 16:28:30.265 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" from croniter import croniter
03-22-2017 16:28:30.265 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" File "/opt/splunk/etc/apps/TA-myta/bin/croniter-0.3.8-py2.7.egg/croniter/__init__.py", line 3, in <module>
03-22-2017 16:28:30.265 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" import abc
03-22-2017 16:28:30.265 +0530 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-myta/bin/myta.py" File "/opt/splunk/etc/apps/TA-myta/bin/croniter-0.3.8-py2.7.egg/croniter/croniter.py", line 8, in <module>
... View more
03-14-2017
02:39 AM
What I meant is, in the commands given by me, replace /opt/splunk with value of your SPLUNK_HOME env variable.
... View more
03-14-2017
02:13 AM
Please replace /opt/splunk with your SPLUNK_HOME value. I forgot to mention that in my comment.
Also, please change your directory to SPLUNK_HOME/TA-QualysCloudPlatform OR change the run.py path accordingly. This script is in TA-QualysCloudPlatform/bin path.
... View more
03-14-2017
01:52 AM
Well, from the error message it seems that Splunk isn't being able to run the TA.
On your UF, can you please run following command: /opt/splunk/bin/splunk cmd python ./bin/run.py -d -s 2017-01-01T00:00:00Z
This will run the TA code, WITHOUT ingesting any data into Splunk. See what Python error/exception you get there. That's probably the reason why Splunk is unable to initialize the scheme.
For more details on this command, you may run this: /opt/splunk/bin/splunk cmd python ./bin/run.py -h
Let's nail it down now.
... View more
03-14-2017
01:32 AM
Can you please confirm the TA version?
Also, have you added any data inputs after you set it up?
... View more
03-08-2017
10:32 PM
1 Karma
You just need to set Extra API Parameter for Host Detection. Go to TA setup page, and in "VM Detection Settings" section, in "Extra parameters to pass to Detection API" field set either of active_kernels_only=1 or {"active_kernels_only": 1} and Save.
From the next run, it will pass that as additional API parameter. You can verify that with this search SPL: index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"
... View more
03-08-2017
09:15 PM
On UFs, you need only TA. On SHs, you need to have VM app.
There's a technical problem with SHC when it comes to knowledgebase. The TA have knowledgebase as a lookup csv. This does not get forwarded by default. Remember, there's a data input for KB as well, so that you can keep updating your Kb copy periodically.
And you need it basically on SHs to provide extra information on some of the reports. So, to solve the problem I would recommend you to setup some remote syncing (rsync etc) to keep on syncing /lookups/qualys_kb.csv file on SHs. Ultimately, your KB data input will periodically update csv file on UFs, and rsync will keep Kb copy on SHs up to date.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
