All Apps and Add-ons

Qualys Technology Add-on (TA) for Splunk: Can the qualys_kb_lookup and qualys_severity_lookup be searchable if the add-on is only installed on one forwarder?

becksyboy
Contributor

In our current environment, we can only allow external API access from one of our forwarders. The idea is to install the Qualys Technology Add-on (TA) for Splunk (TA-QualysCloudPlatform) with a custom TA-QualysCloudPlatform_inputs_app on the forwarder with knowledge_base and host_detection inputs. The data will be indexed into our Indexer cluster and would be searchable via our Enterprise security search head cluster.

We would not be installing the Qualys VM app on the search heads, but would create custom searches. Will the qualys_kb.csv be automatically updated via the knowledge_base input on the forwarder? If we want to utilize the lookups/lookup definitions from the search head, how best can we achieve this? Do we still need to add a copy of our TA-QualysCloudPlatform app to all the search heads?

thanks

0 Karma
1 Solution

koshyk
Super Champion

I hope you have clustered SH and Indexers? Do you have heavy Forwarders?

  • TA-QualysCloudPlatform should be installed on Search Heads, (indexers) & Heavy forwarders (optional)
  • the TA should be in the SH, so it will contain lookups etc. This TA is the heart of your indextime and SEarch time extractions, so without it the fields will be missing
  • If you want to collect the data via heavy-forwarder , you still need to have the TA in heavy forwarders. In your local, you can create a new inputs.conf and put your own "index" etc if you follow index naming standards in your organisation

View solution in original post

0 Karma

koshyk
Super Champion

I hope you have clustered SH and Indexers? Do you have heavy Forwarders?

  • TA-QualysCloudPlatform should be installed on Search Heads, (indexers) & Heavy forwarders (optional)
  • the TA should be in the SH, so it will contain lookups etc. This TA is the heart of your indextime and SEarch time extractions, so without it the fields will be missing
  • If you want to collect the data via heavy-forwarder , you still need to have the TA in heavy forwarders. In your local, you can create a new inputs.conf and put your own "index" etc if you follow index naming standards in your organisation
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...