Dashboard of "Qualys PC App for Splunk Enterprise" remains empty

[rschutt]

It looks like no data for the "Policy Posture" is being fetched. The "WAS"- and "Host Detection"-inputs are working fine.

The Splunk-version is 6.5.2 and below are the events found in "ta_QualysCloudPlatform.log" that are related to this request (debug-mode is enabled). The setting with regards to "Policy Posture" are default.

TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19370 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19406 [MainThread] INFO: TA-QualysCloudPlatform - Index configured: qualys
TA-QualysCloudPlatform: 2018-07-05 02:10:29 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Making request: https://qualysapi.qualys.eu/msp/about.php with params={}
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator started.
File "/opt/splunk/etc/apps/TA-QualysCloudPlatform/bin/qualysModule/qualys_log_populator.py", line 544, in _run
TA-QualysCloudPlatform: 2018-07-05 02:10:31 PID=19371 [MainThread] INFO: TA-QualysCloudPlatform [policy_posture_info] - Qualys PC Posture Populator finished.

Does anyone have the same experience or any idea how we can solve this?

Many thanks!

[rschutt · Accepted solution]

We were able to solve this problem. The problem was caused by the fact that the TA has been deployed from the Forwarder-Manager. This means that we were not able to configure the app from the UI. As a result of the update the TA the Policy-Posture-fetches were added but needed to be configured. So I created an additional stanza in the inputs.conf for the Policy-Posture but the only thing it did was contacting the "About"-page of Qualys.

When I installed the TA on a different stand-alone system and set it up properly I discovered that there were additional options in the qualys.conf-file. Although these are assigning empty values I copied these options to my production-environment and this works.

So the message is, always use the UI to set this up.

Thanks!