ArcSight Qualys Smart Connector - Not Working

[siemops]

Hi All,

We've configured our Qualys Smart Connector according-to the ArcSight Configuration Guide ("SmartConnector for Qualys QualysGuard File") and it's not working. We're using the following URLs (same as config guide):

Scan Report List URL: https://qualysguard.qualys.com/msp/scan_report_list.php

Scan Report URL: https://qualysguard.qualys.com/msp/scan_report.php

We are not using certificates and we are not using a proxy. The user account in Qualys has been set-up for both GUI and API.

Does anyone know what is wrong?

[steve-m]

Are you able to login with the Qualys account to those two URLs? What does agent.log say?

[siemops]

We are currently using the following URLs. When using a browser (IE), I receive data back from them:

https://qualysguard.qg2.apps.qualys.com/fo/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php?ref=scan/1477064802.95844

Here’s the error in agent.log:

[ERROR][default.com.arcsight.agent.m.b][getJobsList]

org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 47; The entity name must immediately follow the '&' in the entity reference.

[Aleks]

Hi Richard,

Try these links:

https://qualysguard.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysguard.qg2.apps.qualys.com/msp/scan_report.php

If it also will not work try these:

https://qualysguard.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

and if not then

https://qualysapi.qg2.apps.qualys.com/msp/report/report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

I don't know why, but in different data-centers links differs so you can not relay on ArcSight configuration guide this question.

By the way, if you want to integrate Mapping, WAS, PC and Patch data and improve scan data duality please take a look at https://www.protect724.hpe.com/docs/DOC-13321 and https://socprime.com/en/cyberview/

Aleks

[siemops]

Thanks for the information, Aleks.

Based on a combination of information, we figured-out what these URLs need to be for us:

https://qualysapi.qg2.apps.qualys.com/msp/scan_report_list.php
https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php

It appears the ArcSight connector only supports Qualys's API version 1.0. URLs were based-on the Qualys API V1 User Guide:

https://www.qualys.com/docs/version/8.8/qualys-api-v1-user-guide.pdf

[steve-m]

Thank you both. I will file a request to have the documentation updated to include this information.

[siemops · Accepted solution]

Just a heads-up, Steve:

These are the URLs that worked for us:

https://qualysapi.qg2.apps.qualys.com/msp/scan_report_list.php

https://qualysapi.qg2.apps.qualys.com/msp/scan_report.php