IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Qradar Vuln. Mgmt. - "Adding a Qualys scheduled import asset report"

  • 1.  Qradar Vuln. Mgmt. - "Adding a Qualys scheduled import asset report"

    Posted Mon October 31, 2022 03:54 PM
    Following the Directions in Adding a Qualys scheduled import asset report
    We are seeing this sit @ "Pending" with no results.

    I've opened a ticket with Qualys Support, but I need the underlying "API Call" that this GUI is making.
    Other API connections work w/ curl commands from the Qradar Console.

    Any ideas what this api call actually is?

    Thanks,
    Troy​

    ------------------------------
    Troy Barnhart
    SD
    ------------------------------


  • 2.  RE: Qradar Vuln. Mgmt. - "Adding a Qualys scheduled import asset report"

    Posted Mon November 07, 2022 01:01 PM
    Troy,
    its been a while I configured that at customer site so my comment is not really up to date. As your post already says this is a scheduled Qualys import from the local Qualys platform. The documentaion allows for CIDR definition which is optional
    • Optional: To configure a CIDR range for your scanner, configure the CIDR range parameters and click Add
    However there is no scheduled scan with Qualys VIS integration, which uses a classical API not the new one which allows for additional qvm searches.
    To me it looks like there is some kind of misunderstanding between QRadar config and your Qualys host. My tip would be to remove the CIDR range in case you have defined one. Try again and double check results. Let me know how it goes.

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------