after commenting out it got past that feed. Then fail on the next https feed. To me without restarting that is, that the issue is when there is a https feed. As soon as i comment out any of https feeds to works? ... View more

I have checked our proxies and everything else inline and can see the sites being accessed. This is what happens when we run the script manually: [*] Script version: 3.00 URL: http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt Finished retrieving 818 IPs from SpamHaus. Finished retrieving 23 IPs from Dshield. Finished retrieving 716 IPs from Feodo. URL: http://rules.emergingthreats.net/blockrules/compromised-ips.txt Finished retrieving 1423 Emerging Threats Compromised IPs. URL: http://www.binarydefense.com/banlist.txt Finished retrieving 4298 IPs from Binary Defense. URL: https://check.torproject.org/exit-addresses Something happened! Error code 500 URL: https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist Page not found! Traceback (most recent call last): File "/apps/splunk/etc/apps/optiv_threat_intel/bin/optiv_threat_lists.py", line 882, in main() File "/apps/splunk/etc/apps/optiv_threat_intel/bin/optiv_threat_lists.py", line 816, in main parseAlienVault(raw_threatlist) File "/apps/splunk/etc/apps/optiv_threat_intel/bin/optiv_threat_lists.py", line 702, in parseAlienVault AlienVaultIPs = urlResults.split('# Generic format') AttributeError: 'int' object has no attribute 'split' ... View more

i am getting the same error: URL: https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist Page not found! If i use curl with the proxy settings i get results? ... View more

Not related to this in a way. But we have our SPlunk running under /apps/splunk. The python script fails as it looks for /opt/splunk and tries to write a log to this location. So you have to edit the python script to change the location of splunk. The Error message you get when running the python script: logfile_name: /opt/splunk/var/log/splunk/optiv_threat_lists_script11-23-2016-23-05-20.log Traceback (most recent call last): File "./optiv_threat_lists.py", line 129, in lf = open(logfile_name,'w') IOError: [Errno 2] No such file or directory: '/opt/splunk/var/log/splunk/optiv_threat_lists_script11-23-2016-23-05-20.log' ... View more

After a while the data did get into the APP ... View more

I thought the same, you have to setup the app to get the folders. The doco for this app isnt very good! ... View more

So the issue was with API access. The best way to find these WAS issues and the answers is from the following search: index=_internal sourcetype=qualys source="qualys://was_findings" ... View more

The only issue i see is the WAS APP. The TA is downloading xml files but not passing them into the APP. ... View more

I have finally got this working again. I removed the application, restarted splunk and installed it again. Double checked the user account had rights to everything. Noticed that the account i was using didnt have rights to view all objects. ... View more

We are experiencing the same issue. Changing the setting to 1200 does now work. ... View more

I have just upgraded away from the Beta version which was working fine. We are getting the same errors? And this one: QualysSplunkPopulator: 2016-08-11T11:14:21Z PID=25745 [MainThread] ERROR: QualysSplunkPopulator - Error during request to /msp/about.php, [None] Unauthorized ... View more

Try logging in using the account you are trying to use for the API. The error stats it cannot access the vm component, so check you have access with the account you are using. You dont need the TA / Add on for Qualys to get things going. Made remove that though it shouldnt make a differennce. ... View more

to me that is populating. When you do a search using index=qualys what do you see? ... View more

You need to have API access and have paid for it. The account details are correct, check the proxy settings if you need to use one. Make sure you have the API server address right: https://qualysapi.qualys.com And enable debug. ... View more

I also do not have any data for installed software. All other dashboards and search are working. I have confirmed the user role and the two indexes. I have also double checked db connect for dbmon-tail://sccm/sccm_installed_software_dbinput. Changed that to 5 minutes.But still no information? Here is what is in the sql query: with software as ( select [timestamp], resourceid, active=1, softwarepropertieshash0, softwarepropertieshashex0, normalizedname as product_name, normalizedversion as product_version, normalizedpublisher as product_publisher, InstallDate0 as installation_date, categoryname as category, familyname as family from v_gs_installed_software_categorized UNION ALL select s.[timestamp], s.resourceid, active=0, s.softwarepropertieshash0, s.softwarepropertieshashex0, coalesce (sl.commonname, s.productname0) as product_name, coalesce (sl.commonpublisher, s.publisher0) as product_publisher, coalesce (sl.commonversion, s.productversion0) as product_version, installdate0 as installation_date, fam.familyname, cat.categoryname from v_hs_installed_software s left outer join v_lu_softwarehash sh on sh.softwarepropertieshash = s.softwarepropertieshash0 left outer join v_lu_softwarelist sl on sl.softwareid = sh.softwareid inner join v_lu_category as cat on cat.categoryid = coalesce(sl.categoryid, 4892) inner join v_lu_family as fam on fam.familyid = coalesce(sl.familyid, 4891) where softwarepropertieshash0 is not null) select * from software {{WHERE $rising_column$ > ?}} ... View more

I got this working, we have api access which we have to pay for but it looks like its worth it. Nice app and is quicker to search Qualys data through splunk than their site. ... View more

ok, i got api access. One note is the user acount needs manager access. Next error: Tunnel connection failed: 503 Service Unavailable ... View more

We do have api access, we use the qualys connector for Sourcefire. Is this the same? ... View more