splunk
Qualys Technology Add-on (TA) for Splunk
Splunk Cloud
Overview
Details
The Qualys Technology Add-on (TA) for Splunk is a Technology Add-On for Qualys Cloud Platform data. It fetches Vulnerability Management (VM), Web Application Scanning (WAS), Policy Compliance (PC), Container Security(CS), File Integrity Monitoring(FIM), Endpoint Detection & Response (EDR), Security Enterprise Mobility (SEM), Activity Log and KnowledgeBase (KB) data using modular input and indexes it which then can be searched using the Search app, Splunk Enterprise Security app or the Qualys VM App, WAS App or PC App, EDR App, FIM App, CS App , Policy Compliance Reporting Services (PCRS) App for Splunk Enterprise.
Support and resources
For documentation please see: https://community.qualys.com/docs/DOC-4876
Support
In case any assistance is needed, please visit https://www.qualys.com/forms/contact-support/
Release Notes
Version 1.10.5
Sept. 6, 2022
- Extended the compatibility with Splunk 9.0
- Enhanced the VM and KB data input for parsing and ingesting of additional fields data into Splunk
- Minor fixes and improvements
Version 1.10.4
June 30, 2022
- TA can now fetch and parse CLOUD_PROVIDER_TAGS information
- Minor enhancements in the Host Detection data pulling
Note: Not compatible with Splunk 9.0
Version 1.10.3
June 3, 2022
- Fix for STIG Reference Number in Policy Posture data
Version 1.10.2
May 23, 2022
- Improvements in logging and minor enhancements
Version 1.10.1
April 19, 2022
- Integration of the Qualys Policy Compliance Reporting Service (PCRS) with Splunk TA
- PCRS improves the data fetching of the huge data from the Qualys Cloud
- PCRS fetches data continuously in the streaming manner hence, millions of assets and postures can be pulled quickly as compared to
legacy PC - Minor bug fixes and improvements
Version 1.9.1
Dec. 21, 2021
- Minor bug fixes and improvements
Version 1.9.0
Dec. 14, 2021
- Integration of the Qualys Secure Enterprise Mobility with Splunk TA
- User can view Diagnosis, Consequence, and Solution information in Knowledgebase data in Splunk by enabling it from the TA setup page
- Minor bug fixes and enhancements
Version 1.8.11
Nov. 19, 2021
Bug fixes
Users can now ingest detected service names in the event along with TCP/UDP ports
Version 1.8.10
Oct. 28, 2021
Users can now ingest detected service names in the event along with TCP/UDP ports
Version 1.8.9
July 15, 2021
ATTENTION PLEASE!
1) Changes to the TA setup page for Qualys API credentials: We have added a realm for Qualys API credentials that get stored in 'passwords.conf' file. When you upgrade to TA 1.8.9, please re-enter the Qualys API credentials. The TA won't be able to access the Qualys API credentials until then. We recommend you empty the cache of your browser and do a hard reload before entering the credentials.
2) The Indication of Compromise (IOC) data inputs rebranded as Endpoint Detection and Response (EDR) data inputs: From this version, the TA will show a deprecation warning in the TA log for IOC data input. Please disable and delete earlier IOC data input and add a new EDR data input. You can use the new Qualys EDR App for Splunk Enterprise.
Other Fixes:
1) Fixed 400 Bad Request issues for certain pagination calls for Container Security.
2) Fixed incomplete API response XML file issue for Policy Compliance.
3) Added milliseconds in the checkpoint file for FIM data inputs to be compliant with API.
Version 1.8.8
May 27, 2021
- FIM data inputs will accept the date format for milliseconds
Version 1.8.7
May 18, 2021
- Updated CS Images and CS Containers API version to 1.3
- Added DISA STIG SV values to PC Data Input
- Minor improvements on the TA setup page
Version 1.8.6
April 8, 2021
- The processing logic of Policy Compliance posture information has been changed.
- The logic of XML file processing has been changed.
- Help text on the data inputs page has been updated.
Version 1.8.5
March 8, 2021
Host and Detection fields to log are now configurable from the TA setup page
Truncate the Results field at the TA side
Version 1.8.4
Dec. 4, 2020
- Knowledgebase data can now be indexed as well, by enabling the indexing from the TA Setup page, this feature will mainly help in Splunk distributed setup.
- Container Security image data input has the capability to index image label info.
- Minor improvements for fields validation on the setup page.
Version 1.8.3
Nov. 6, 2020
Features / Improvements:
Read the VM data input configuration values from 'qualys.conf' instead of the app configuration file
New logic implemented for policy ids distribution for PC data input
Bug Fixes:
VM host summary logged in Splunk even though excluded in the TA setup
WAS summary events were not indexing while WAS data input was running in multi-thread mode
PC Evidence details were not logged in case 'lastUpdated' attribute not present in the API output
Version 1.8.2
Oct. 7, 2020
- Enhancements to VM Detection Event, moved the Results field to the end of the event
Version 1.8.1
Sept. 9, 2020
-Fix for byte string present in the data ingested for host detection in Splunk version 8.0.0 or higher which uses Python 3 interpreter
-Added support for activity_log data feed in cleanup.py and run.py scripts
-Added validation for Start date while adding/editing data input
Version 1.8.0
July 28, 2020
- Splunk Cloud Compatibility changes - Setup xml replaced with Setup view. We have also done visualization changes to the Setup page.
- New data feed - Activity Log. The user activity log that you see on Qualys UI > User > Activity Log, can now ingest.
- Added Page Size field on the Setup page for CS, FIM, and IOC to control the number of records returned in API calls