Hello! It seems 6 years have gone by and we still don't have an official stand from Qualys, which to me is mind blowing, they have the scale, resources and responsibility to make this work. Anyways... Do you know of any work around that has come lately related to this? Thank you! ... View more

thank you to your answer. I've found, actually, in the official TA doc, that I could have some extra fields in the knowledge base,including the solution, modifing the kbpopulatory script. I will try it soon. thanks again 🙂 ... View more

@Prabas - is the latest version of the TA 1.1.0 supported on SHC? It throws similar errors. ... View more

This worked after I updated the add-on. Thanks! ... View more

First of all it would help if you could give us the Name of the TA. In most TAs is an README File qhere you can find further Instructions. For the credential Setup. Take a look in your "%splunkroot%\etc\apps[TA_NAME]\default" directory. Are there some config files? If yes, take a look at them. (please DONT edit them) If you can find the nessesary parameters, copy the Files you need to edit to "%splunkroot%\etc\apps[TA_NAME]\local" and edit them there. ... View more

For me also getting some kind of different error for both was_findings and knowledge_base. Any please or suggestion will be highly appreciate. Log source path is "ta_QualysCloudPlatform.log" under /opt/splunk/var/log/splunk. [was_findings] TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] DEBUG: TA-QualysCloudPlatform [knowledge_base] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Start logging knowledgebase TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Outputting logs to stdout TA-QualysCloudPlatform: 2017-10-15T10:12:15Z PID=9027 [MainThread] INFO: TA-QualysCloudPlatform [knowledge_base] - Making request: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'} TA-QualysCloudPlatform: 2017-10-15T10:12:16Z PID=9027 [MainThread] ERROR: TA-QualysCloudPlatform [knowledge_base] - Unsuccessful while calling API [403 : Forbidden]. Retrying: https://qualysapi.qualys.eu/api/2.0/fo/knowledge_base/vuln/ with params={'details': 'Basic', 'action': 'list'}. Retry count: 1 [knowledge_base] TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Loading custom settings TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Start TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS findings were last fetched on 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching WAS findings data for Hosts which were scanned after 1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Fetching all WAS detection data TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Running in single thread mode TA-QualysCloudPlatform: 2017-10-15T13:14:20Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Making request: https://qualysapi.qualys.eu/qps/rest/3.0/search/was/finding with params=true1999-01-01T00:00:00Z TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - WAS detection fetched TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Parsing WAS detection XML TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - API Response Code = UNAUTHORIZED TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] DEBUG: TA-QualysCloudPlatform [was_findings] - Exception while parsing. API ERROR. Message=UNAUTHORIZED :: Traceback (most recent call last): TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] ERROR: TA-QualysCloudPlatform [was_findings] - could not load API response TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - Done TA-QualysCloudPlatform: 2017-10-15T13:14:21Z PID=13220 [MainThread] INFO: TA-QualysCloudPlatform [was_findings] - was_findings run completed. Sleeping for 10800s ... View more

So there was a bug that was listed as fixed in the latest version of the TA. It wasn't until the TA was upgraded that I was able to pull the results fields with no additional editing. Unfortunately, prabhasgutpe's comments about multi-lined results fields rings very true. While it's able to pull the data, it's absolutely useless because of incorrect handling of the multi-lined fields. It'd be great for the data source to be cleaned up so it presents the data in a usable fashion OR the add-on is updated to accommodate the multi-lined fields. ... View more

Good to see your problem no more exists! There's really no magic in WAS app, its just a bunch of dashboards and reports. TA ingests data into Splunk and then this app just do the reporting part on top of that. Must be some delay in events association at Splunk level. 🙂 ... View more

Please have a look at the sample app for start : http://dev.splunk.com/view/SP-CAAAEZT http://dev.splunk.com/view/webframework-developapps/SP-CAAAEY7 http://dev.splunk.com/view/SP-CAAAEZG ... View more

works great, appreciated! ... View more

No you don't have to map all of your fields when creating the data model. You may have 50 data fields but only want 25 in your data model, you set this when creating it, you specify the fields to include. Have a look at the Knowledge Manager Manual located here for more detail: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/WhatisSplunkknowledge ... View more

does this help? http://blogs.splunk.com/2015/05/01/relating-add-ons-to-cim/ -- I'd expect the "Data Model Tag Population By Add-on" report to list your add-on next to vulnerability? ... View more

Well, the only reason data wasn't showing up in CIM app was the app name. As per Splunk, the app name must start with TA or SA or DA.. only then it is recognized as CIM compliant app. ... View more

If you haven’t seen it yet, you might want to check out the Splunk reference app with associated developer guidance that was built by a Splunk dev team. The current version covers app development topics from getting your data into Splunk Enterprise to building custom reporting through testing and packaging your app. There’s code and tests you can use and the development process is fully documented. This is an ongoing dev effort by the team so check back often to see what’s been added. Also, feel free to post requests for future improvements and even contribute by reporting bugs or submitting pull requests. ... View more

I am facing the same error in Splunk CIM app. "Eventtype '' does not exist or is disabled." This event is not disabled, and it even have global permission. Whereas, if I use 'Search & Reporting' app, I can see that event. ... View more