We've configured our Qualys Smart Connector according-to the ArcSight Configuration Guide ("SmartConnector for Qualys QualysGuard File") and it's not working. We're using the following URLs (same as config guide):
Scan Report List URL: https://qualysguard.qualys.com/msp/scan_report_list.php
Scan Report URL: https://qualysguard.qualys.com/msp/scan_report.php
We are not using certificates and we are not using a proxy. The user account in Qualys has been set-up for both GUI and API.
Does anyone know what is wrong?
We are currently using the following URLs. When using a browser (IE), I receive data back from them:
Here’s the error in agent.log:
org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 47; The entity name must immediately follow the '&' in the entity reference.
Try these links:
If it also will not work try these:
and if not then
I don't know why, but in different data-centers links differs so you can not relay on ArcSight configuration guide this question.
By the way, if you want to integrate Mapping, WAS, PC and Patch data and improve scan data duality please take a look at https://www.protect724.hpe.com/docs/DOC-13321 and https://socprime.com/en/cyberview/
Thanks for the information, Aleks.
Based on a combination of information, we figured-out what these URLs need to be for us:
It appears the ArcSight connector only supports Qualys's API version 1.0. URLs were based-on the Qualys API V1 User Guide: