Hi, I have successfullly configured the Qualys TA and everything seems to be working just fine. I have enabled the Knowledge Base and Host Detection inputs and it's indexing and searchable. The inputs are set up to run once a day and as such that is what happens. There is always a but 🙂 BUT... I can see that the TA is polling the Qualys Cloud every minute even when it is not actually going to trigger an API call to retrieve the data. This is what I can see in my ta_QualysCloudPlatform.log: TA-QualysCloudPlatform: 2018-03-28T11:17:28Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - Start qualys TA TA-QualysCloudPlatform: 2018-03-28T11:17:28Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - TA-QualysCloudPlatform using username ******. TA-QualysCloudPlatform: 2018-03-28T11:17:28Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - Making request: https://qualysapi.qualys.eu/msp/about.php with params={} TA-QualysCloudPlatform: 2018-03-28T11:17:29Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - Found QWEB_VERSION=8.12 TA-QualysCloudPlatform: 2018-03-28T11:17:29Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - Running for qualys://host_detection TA-QualysCloudPlatform: 2018-03-28T11:17:29Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - host_detection cron/duration: 01 05 * * * TA-QualysCloudPlatform: 2018-03-28T11:17:29Z PID=1260 [MainThread] INFO: TA-QualysCloudPlatform - Current time (2018-03-28 11:17:00) does not match cron format (01 05 * * *) defined for host_detection. Will not run. Next run is on 2018-03-29 05:01:00 So as you can see the TA connects to Qualys and makes the request "https://qualysapi.qualys.eu/msp/about.php with params={}" but subsequently confirms that it's not actually time to run. It's not a major thing but it is being flagged by our VM team as they are seeing the activity filling the logs on the Qualys side. I have raised it with Qualys to see if this is normal behaviour and more importantly if this counts toward our API call limit. I am pretty confident that this is absolutely fine but would be interested to hear if anyone has found a way to limit these logins to appease the local VM team. ... View more

Hi, I have a Splunk stand alone test system that I have successfully configured to use LDAP Authentication. Everything seems to be working fine but I am receiving a lot of errors from the Authentication Manager (see below) that is trying to obtain user information for the user 'system'. The user has never existed in as far as I can tell. I have also checked through the metadata files for any reference to the user but cannot find anything. DEBUG AuthenticationManagerLDAP - Attempting to get user information for user="**system**" from strategy="XXX-Strategy" DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" Initializing with LDAPURL="ldaps://XXX:636" DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" Attempting bind as DN="CN=XXX,OU=XXX,OU=XXX,DC=XXX,DC=XXX,DC=XXX" DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" Bind successful DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" Attempting to search subtree at DN="OU=XXX,OU=XXX,DC=XXX,DC=XXX,DC=XXX" using filter="(&(samaccountname=**system**)(displayname=*))" DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" Search duration="1477 microseconds" DEBUG ScopedLDAPConnection - strategy="XXX-Strategy" LDAP Server returned no entries in search for DN="OU=XXX,OU=XXX,DC=XXX,DC=XXX,DC=XXX" filter="(&(samaccountname=**system**)(displayname=*))". As you can see there is a successful LDAP bind but then several failed attempts to enumerate the 'system' user (not repeated here). I have checked the archives and can only find references to the possiblity that 'system' may own some objects (searches, views etc) but I have checked all the *.meta files and cannot find any references to any non-existent users other than 'nobody' and 'splunk-system-user'. Can anyone shed any light? ... View more