Certview Settings

Configure the Certview Settings to fetch the asset details from your subscribed Qualys Certview account.

certview_settings

You can configure the following settings in CertView Settings

Setting

Description

Page size (max 200)

Specify the number of records to be fetched in single API call.

Default: 10 records

maximum: 200

Extra filters for CertView API

Provide the extra filters, if any.

Filter should be in the following format {"filters": [{"field": "fieldName", "value": "Value", "operator": "operator"},{"field": "fieldName", "value": "Value", "operator": "operator"}]}.

For example: {"filters": [{"field": "inventory.source", "value": "IP", "operator": "EQUALS"},{"field": "operatingSystem", "value": "Linux", "operator": "EQUALS"}]}

For more information on this, refer to the API User guide.

CertView custom operation

There are 3 options to define the operation:

  • Include Fields: include only the entered fields
  • Exclude Fields: exclude the entered fields
  • None: use default API Response

CertView Custom Fields

You can either include or exclude fields based on the radio buttons selected in CertView custom operation, enter the field names comma separated in the Custom fields text box.

Include Fields - Includes the specified parameters in the response.

For example- ASSET_INTERFACES, VULNERABILITIES, SSL_PROTOCOLS, CIPHER_SUITES, ASSET_TAGS, EXTENSIVE_CERTIFICATE_INFO

Exclude Fields - Exclude the specified parameters from the response.

For example- certificate.certhash, certificate.keySize, asset.netbiosName, asset.uuid.

For more information on include and exclude fields, refer to the API user guide. 

Certview Maximum API retry count

This field defines the number of times TA can retry the API call after any error occurs. TA stops the data input run after the maximum retry count exceeds. In the checkpoint file, it stores the last-seen certificate details, like page number and certificate updated datetime, and starts the next run according to the cron schedule. It then picks up page number and certificate updated datetime from the last run and pulls the remaining data.

Event Types for CertView in Splunk

You can use default event types to search for CertView data pulled in Splunk. For more information, refer to Event Types for searching your apps data.