Configure Application

In the following sections application configuration steps are explained.

Qualys API Configurations

Perform the following steps in QRadar :

1. Go to the Admin tab.
2. Scroll to the Apps section.

3. Click Qualys FIM App Settings.

   A pop-up window opens. Go to Advanced Configuration.

Authorization Token

QRadar's Authorization token is used to interact securely with QRadar. You can obtain this token from Admin > User Management > Authorized Service.

Following are the steps to generate an Authorization Token:

1. Go to Authorized Services in the Admin tab
2. Click Add Authorized Service.
3. Enter the desired Service Name.
4. Select User Role as Admin.
5. Select Security Profile as Admin.
6. Set the expiry date as required.
7. Click Create Service and then click Deploy changes.
8.  click Save under the settings tab after providing the Authorization Token

Settings

Use the Settings tab to configure your Qualys credentials. Enter your Qualys API server, username, and password in the appropriate fields.

Log Source

Perform the following steps in the Log Source:

1. Select Log Source for Events as QualysFimMultiline
2. Select Log Source for Incidents as QualysFimIncidents

Proxy Configuration

Configure proxy details if you want the Qualys app to use a proxy while calling the API.

1. Select Use a proxy server for API call to enable proxy.
2. Add your proxy server and proxy port in <proxy server>:<proxy port> format.

If your proxy needs authentication, add the proxy user and proxy password along with the server and port in <proxy user>:<proxy password>@<proxy server>:<proxy port> format.

FIM Events

Use the FIM Events tab to configure and enable Fetch FIM Events.

1. Select the Enable FIM Events Fetch to enable this data input.
2. Enter a valid cron format entry in the Cron Schedule field. This field is mandatory if the Enable FIM Events option is selected. Learn about cron expression.
3. In the Start Date-Time field, enter the date-time from which you want to fetch the FIM events data from Qualys.
   • This is an optional field.
   • The date-time format should be 'YYYY-MM-DDTHH:MM:SS.MSZ. e.g. '2019-02-25T18:30:00.000Z. 
   • If the value is not provided, FIM events are fetched from the browser's current date. The start date shouldn't be less than 2017-01-01T00:00:00.000Z. 

4. In the Filter field, enter filter criteria to filter the FIM events.

   • This is an optional field.

   • The filter fields should be in Elastic Search Query format. 

5. From the Select log level, select the required log level out of the following options:

   • INFO

   • DEBUG

   • WARNING

   • ERROR

FIM Ignored Events

Use the FIM Ignored Events tab to configure and enable Fetch FIM Ignored Events.

1. Select the Enable FIM Ignored Events Fetch to enable this data input.
2. In the Cron Schedule field, enter a valid cron format entry. This field is mandatory if the Enable FIM Ignored Events option s selected.
3. In the Start Date-Time field, enter the date-time from which you want to fetch the FIM Ignored events data from the Qualys.
   • This is an optional field.
   • The date-time format should be 'YYYY-MM-DDTHH:MM:SS.MSZ. e.g. '2019-02-25T18:30:00.000Z. 
   • If the value is not provided, FIM events are fetched from the browser's current date. The start date shouldn't be less than 2017-01-01T00:00:00.000Z. 

4. Enter extra filter criteria to filter the FIM Ignored events in the Filter field.

   • This is an optional field.
   • The filter fields should be in Elastic Search Query format. 

5. From the Select log level, select the required log level out of the following options:

   • INFO
   • DEBUG
   • WARNING
   • ERROR

FIM Incidents

Use the FIM Incidents tab to configure and enable Fetch FIM Incidents.

1. Select the Enable FIM Incidents Fetch to enable this data input.
2. Enter a valid cron format entry in the Cron Schedule field. This field is mandatory if the Enable FIM Events checkbox is checked. Learn about cron expressions
3. In the Start Date-Time field, enter the date-time from which you want to fetch the FIM events data from Qualys.
   • This is an optional field.
   • The date-time format should be 'YYYY-MM-DDTHH:MM:SS.MSZ. e.g. '2019-02-25T18:30:00.000Z. 
   • If the value is not provided, FIM events are fetched from the browser's current date. The start date shouldn't be less than 2017-01-01T00:00:00.000Z. 
4. In the Filter field, enter filter criteria to filter the FIM events.
   • This is an optional field.
   • The filter fields should be in Elastic Search Query format. 

5. From the Select log level drop-down menu, select the required log level out of the following options:

   • INFO
   • DEBUG
   • WARNING
   • ERROR

Advanced

Use the Advanced tab to see the last success and failure for FIM Events, FIM Ignored Events and FIM Incidents.

Next Step

Advanced Configuration