siemops Super Contributor.
Super Contributor.
811 views

ArcSight Qualys Smart Connector - Not Working

Jump to solution

Hi All,

We've configured our Qualys Smart Connector according-to the ArcSight Configuration Guide ("SmartConnector for Qualys QualysGuard File") and it's not working. We're using the following URLs (same as config guide):

Scan Report List URL: https://qualysguard.qualys.com/msp/scan_report_list.php

Scan Report URL: https://qualysguard.qualys.com/msp/scan_report.php

We are not using certificates and we are not using a proxy. The user account in Qualys has been set-up for both GUI and API.

Does anyone know what is wrong?

Labels (1)
0 Likes
1 Solution

Accepted Solutions
siemops Super Contributor.
Super Contributor.

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution
0 Likes
6 Replies
Micro Focus Expert
Micro Focus Expert

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution

Are you able to login with the Qualys account to those two URLs? What does agent.log say?

0 Likes
siemops Super Contributor.
Super Contributor.

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution

We are currently using the following URLs. When using a browser (IE), I receive data back from them:

https://qualysguard.qg2.apps.qualys.com/fo/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php?ref=scan/1477064802.95844

Here’s the error in agent.log:

[ERROR][default.com.arcsight.agent.m.b][getJobsList]

org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 47; The entity name must immediately follow the '&' in the entity reference.

0 Likes
Highlighted
Aleks Super Contributor.
Super Contributor.

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution

Hi Richard,

Try these links:

https://qualysguard.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysguard.qg2.apps.qualys.com/msp/scan_report.php

If it also will not work try these:

https://qualysguard.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

and if not then

https://qualysapi.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

I don't know why, but in different data-centers links differs so you can not relay on ArcSight configuration guide this question.

By the way, if you want to integrate Mapping, WAS, PC and Patch data and improve scan data duality please take a look at https://www.protect724.hpe.com/docs/DOC-13321 and https://socprime.com/en/cyberview/

Aleks

0 Likes
siemops Super Contributor.
Super Contributor.

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution

Thanks for the information, Aleks.

Based on a combination of information, we figured-out what these URLs need to be for us:

https://qualysapi.qg2.apps.qualys.com/msp/scan_report_list.php
https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

It appears the ArcSight connector only supports Qualys's API version 1.0. URLs were based-on the Qualys API V1 User Guide:

https://www.qualys.com/docs/version/8.8/qualys-api-v1-user-guide.pdf

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution

Thank you both. I will file a request to have the documentation updated to include this information.

0 Likes
siemops Super Contributor.
Super Contributor.

Re: ArcSight Qualys Smart Connector - Not Working

Jump to solution
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.