Hi @bdpummer, The Qualys TA does not support data deletion. However, if you know the purged host ids, you can use Splunk's delete command. It will stop those records from appearing in subsequent searches. But be aware that, the delete command does not reclaim the disk space. ... View more

Hi @derjosh , Single installation of Qualys TA does not support multiple Qualys accounts (at this moment). That's mainly because the TA setup page can handle only one pair of credentials for now. However, if you are comfortable with Splunk distributed setup, you can have multiple forwarders having Qualys TA on each of them. Then, configure your different Qualys accounts on each of them and set them to forward data to single indexer. ... View more

@guarisma As @lakshman239 suggested, please contact Qualys Support and open a Feature Request. ... View more

Hi @cwvos , Can you please confirm which Qualys TA version you are using? ... View more

@jadengoho, you need to contact your Qualys technical account manager (TAM) to enable WAS Access, and possibly API access as well. That will solve your "UNAUTHORIZED" issue. The Qualys TA recommends using cron format to have more control on your data input execution time. So, it would be better if you switch to that. It still supports the older way of w/d/h/m/s (weeks/days/hours/minutes/seconds), but that works differently. When using these older options, the TA will sleep for that many duration before running again. (and trust me, that is risky!) For the duration field, you set 86400, which does not fit in either of old way or cron way, hence that error. ... View more

Hi @AlexeySh, do you see any errors in splunkd.log regarding this? If yes, can you post them here? ... View more

Can this be of any help to you? Replace the CVE with input token or change it to whichever you are searching for. eventtype="qualys_vm_detection_event" cve=*CVE-2016-5554* | dedup 1 HOST_ID, QID | table HOST_ID, IP, QID, cve Change the query as per your need. ... View more

I assume that you are using TA 1.2.2+ To get the RESULTS field indexed in host detection input, do the followings: On TA Setup page, in VM Detection extra parameters, set show_results=0 Open bin/qualysModule/splunkpopulator/detectionpopulator.py and find class HostDetectionPopulator. In this class, find _process_root_element(self, elem) method. In that method, we have a list named HostDetectionPopulator.detection_fields_to_log. Its a list of fields to parse from detection tag. If you don't find it, you can copy one from the top of the same class. In that list, add "RESULTS" at the end. As a best practice, add a comment describing why you edited this list. This will tell code to parse that XML tag as well and output it while printing the event data. Save the file and restart your Splunk. Let me draw your attention to the fact that, RESULTS in host detection API output could be multi-line text. As KV_MODE is set to auto for hostDetection input in props.conf, we are not sure how Splunk will treat the events when RESULTS field is multi-line text. It may or may not consider the multi-line text to be the part of same single event. The newline character might confuse Splunk's event detection. ... View more

@kiran331, have you tried this one? ... View more

You should be able to see tags in HOSTSUMMARY events (eventtype=qualys_host_summary_event). Tags would be in comma-separated string. Can you add extraction for that on your own? ... View more

What I meant is, in the commands given by me, replace /opt/splunk with value of your SPLUNK_HOME env variable. ... View more

Please replace /opt/splunk with your SPLUNK_HOME value. I forgot to mention that in my comment. Also, please change your directory to SPLUNK_HOME/TA-QualysCloudPlatform OR change the run.py path accordingly. This script is in TA-QualysCloudPlatform/bin path. ... View more

Well, from the error message it seems that Splunk isn't being able to run the TA. On your UF, can you please run following command: /opt/splunk/bin/splunk cmd python ./bin/run.py -d -s 2017-01-01T00:00:00Z This will run the TA code, WITHOUT ingesting any data into Splunk. See what Python error/exception you get there. That's probably the reason why Splunk is unable to initialize the scheme. For more details on this command, you may run this: /opt/splunk/bin/splunk cmd python ./bin/run.py -h Let's nail it down now. ... View more

Can you please confirm the TA version? Also, have you added any data inputs after you set it up? ... View more

On UFs, you need only TA. On SHs, you need to have VM app. There's a technical problem with SHC when it comes to knowledgebase. The TA have knowledgebase as a lookup csv. This does not get forwarded by default. Remember, there's a data input for KB as well, so that you can keep updating your Kb copy periodically. And you need it basically on SHs to provide extra information on some of the reports. So, to solve the problem I would recommend you to setup some remote syncing (rsync etc) to keep on syncing /lookups/qualys_kb.csv file on SHs. Ultimately, your KB data input will periodically update csv file on UFs, and rsync will keep Kb copy on SHs up to date. ... View more

Did you try using it on Splunk 6.5? The app is compatible with Splunk 6.5, it app works fine on that version as well. I haven't noticed any broken thing there. It's just that app page isn't updated with that version number. ... View more

Good to see your problem no more exists! There's really no magic in WAS app, its just a bunch of dashboards and reports. TA ingests data into Splunk and then this app just do the reporting part on top of that. Must be some delay in events association at Splunk level. 🙂 ... View more

There's a new version 1.1.0 of Qualys TA for Splunk available in Splunkbase. I would suggest you upgrade to that. There's a major difference between 1.1.0 and earlier versions regarding how the API credentials are stored. That would help you get rid of this error. ... View more

Hi, following are working steps to parse the host tags. Please note, Tags will be added to host summary events (lines starting with HOSTSUMMARY:) Steps: 1) On setup page, set Host detection extra parameter field: 'show_tags=1' 2) Take a backup of this file: /etc/apps/TA-QualysCloudPlatform/bin/qualysModule/splunkpopulator/detectionpopulator.py 3) Open and Edit code file: /etc/apps/TA-QualysCloudPlatform/bin/qualysModule/splunkpopulator/detectionpopulator.py Tags are shown like this in API response: <TAGS> <TAG> <TAG_ID> <![CDATA[12345]]> </TAG_ID> <NAME> <![CDATA[Test]]> </NAME> </TAG> <TAG> <TAG_ID> <![CDATA[12346]]> </TAG_ID> <NAME> <![CDATA[Test-2]]> </NAME> </TAG> </TAGS> So, you will have to add TAGS to host_fields_to_log. 3.1 - Telling code to parse tags search for method "_process_root_element" in class "HostDetectionPopulator". Put following line as fist line of this method: HostDetectionPopulator.host_fields_to_log = ["ID", "IP", "TRACKING_METHOD", "DNS", "NETBIOS", "OS", "LAST_SCAN_DATETIME", "TAGS"] Edit it as per your need. 3.2 - outputting tags inline with current style in the same file, go to Look for 'if' condition shown below. class HostDetectionPopulator(BasePopulator): ... def _process_root_element(self, elem): ... if name in HostDetectionPopulator.host_fields_to_log: val = sub_ele.text if name in fields_to_encode: val = val.encode('utf-8') host_summary.append("%s=\"%s\"" % (name, val)) Now, because of #3.1 above, your code enters this if block. Check if name == 'TAGS'. If yes, you will have to parse the sub-XML (You will have to read TAG.NAME for each child of TAGS element.) Since there could be multiple tags associated with host, its better to put them in list and then joining them while outputing. Refering to same if block (indicated above), replace following line: val = sub_ele.text with code block below: if name == "TAGS": host_tags = [] tag_elements = sub_ele.findall('./TAG/NAME') for tag_element in list(tag_elements): host_tags.append(tag_element.text) # for val = ",".join(host_tags) # tags parsing ends here else: val = sub_ele.text 4) Save the file and restart your Splunk. Now, your _process_root_element method should look similar to this: class HostDetectionPopulator(BasePopulator): ... def _process_root_element(self, elem): HostDetectionPopulator.host_fields_to_log = ["ID", "IP", "TRACKING_METHOD", "DNS", "NETBIOS", "OS", "LAST_SCAN_DATETIME", "TAGS"] ... if name in HostDetectionPopulator.host_fields_to_log: if name == "TAGS": host_tags = [] tag_elements = sub_ele.findall('./TAG/NAME') for tag_element in list(tag_elements): host_tags.append(tag_element.text) # for val = ",".join(host_tags) # tags parsing ends here else: val = sub_ele.text if name in fields_to_encode: val = val.encode('utf-8') host_summary.append("%s=\"%s\"" % (name, val)) Check if you are now getting host tags in host summary events (Splunk events starting with HOSTSUMMARY:) If anything goes wrong, restore the backup and restart your Splunk. Let me know if that helps you. ... View more

Can you please elaborate what issue you are facing with WAS app? ... View more