The Qualys
Connected Assets and Risk connector can be run in the
platform cluster. The connector incrementally synchronizes the contents of the Qualys asset databases with the data that is managed by
the Connected Assets and Risk service.
Before you begin
Collaborate with a Qualys administrator
or account owner to obtain login credentials to access the Qualys platform and API. An API/Login credential pair
(username and password) can be generated by Manager. For more information, see Qualys User
Management
(https://qualysguard.qg1.apps.qualys.in/qwebhelp/fo_portal/index.htm#t=user_management.htm).If you have a firewall between your cluster and the data source target, use the
IBM® Security Edge Gateway to host the containers. The Edge Gateway must be version 1.6 or later. For more
information, see Setting up
Edge Gateway.
About this task
The Qualys connector is designed to work
with Qualys version 3.9.1.0-5 by using the Asset
Management and VMDR APIs.
- The Qualys
Connected Assets and Risk connector is designed to work
with Qualys version 3.9.1.0-5.
- The following Qualys modules are required by
this connector:
Procedure
- Log in to IBM Security QRadar® Suite Software.
- From the menu, click
.
- On the Integration data sources page, on the
Qualys tile, click Set up a connection.
- On the Connection services page, select the Connected
assets & risk service tile, and then click
Enable.
- Click Next.
- On the Connection
details page, configure the following parameters.
- Configure the connection to the data source.
Table 1. Connection parameters
Parameter |
Description |
Data source name |
Enter a unique name to identify the data source connection. You can create multiple
connections to a data source, so it is useful to clearly set them apart by name. Only
alphanumeric characters and the following special characters are allowed: - .
_
|
Data source description |
Enter a description to indicate the purpose of the data source connection. You can create
multiple connections to a data source, so it is useful to clearly indicate the purpose of each
connection by description. Only alphanumeric characters and the following special characters are
allowed: - . _
|
Edge gateway |
If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the
Edge gateway field, specify an Edge Gateway to host the connector. It can take up to
five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
|
host |
Enter the Qualys API Server URL. |
Frequency |
Select how often the connector imports data from the data source, in minutes. The value must
be an integer. For example, a value of 5 causes the connector to run every 5
minutes. If the data source doesn't have many assets, or you don't want to import data often, reduce
the frequency. |
- Click Next.
- On the Connection
configurations page, configure identity and access.
- Click Add a configuration.
- In the Configuration details window,
configure the following parameters.
Table 2. Configuration parameters
Parameter |
Description |
Configuration Name |
Enter a unique name to describe the access configuration and distinguish it from the other
access configurations for this data source connection that you might set up. Only alphanumeric
characters and the following special characters are allowed: - . _ |
Configuration Description |
Enter a unique description to describe the access configuration and distinguish it from the
other access configurations for this data source connection that you might set up. Only alphanumeric
characters and the following special characters are allowed: - . _ |
Qualys Gateway |
Enter the Qualys API Gateway URL. For more information on Qualys platform URLs, see Identify your
Qualys platform
(https://www.qualys.com/platform-identification/). |
Username |
Enter the username from Qualys
connector. |
Password |
Enter the password from Qualys
credentials. |
- To save your configuration and establish the connection, click
Save.
- Click Finish.
- To manage your active connections, complete the following
steps:
- On the Integration data sources page, on the tile of the relevant
data source, click Manage <x> of <x> active
connections.
- On the Connection status page, on the tile of the relevant data
source, you can edit, refresh, or delete your data source connection.
Results
The connector imports data from the data source. The
connector imports data again at the interval that you set in the Frequency
field.
Tip: After you connect a data source, the data retrieval time depends on the selected
frequency duration (maximum time set in the cronjob). Before the full data set is returned, the data
source is in Contacting Service status. After the data is returned, the data
source shows as being connected, and will update the connection status for every cronjob run
thereafter.
You can add other connection configurations for this data
source that have different users and different data access permissions.
What to do next
Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In
Data Explorer, click an IP address to view
its associated assets and risk.
To use Data Explorer,
you must have data sources that are connected so that the application can run queries and retrieve
results across a unified set of data sources. The search results vary depending on the data that is
contained in your configured data sources. For more information about how to build a query in
Data Explorer, see Build a query.