Certview Settings

Configure the Certview Settings to fetch the asset details from your subscribed Qualys Certview account.

certview_settings

You can configure the following settings in CertView Settings

Setting

Description

Page size (max 200)

Specify the number of records to be fetched in single API call.

Default: 10 records

maximum: 200

Extra filters for CertView API

Provide the extra filters, if any.

Filter should be in the following format {"filters": [{"field": "fieldName", "value": "Value", "operator": "operator"},{"field": "fieldName", "value": "Value", "operator": "operator"}]}.

For example: {"filters": [{"field": "inventory.source", "value": "IP", "operator": "EQUALS"},{"field": "operatingSystem", "value": "Linux", "operator": "EQUALS"}]}

For more information on this, refer to the API User guide.

CertView custom operation

Note: Select Include Fields to return only the specified fields along with the default fields. Select Exclude Fields to omit the specified fields from the API response. Select None to use the default API response.

CertView Custom Fields

You can either include or exclude fields based on the radio buttons selected in CertView custom operation, enter the field names comma separated in the Custom fields text box.

Include Fields - Includes the specified parameters in the response.

For example- ASSET_INTERFACES, VULNERABILITIES, SSL_PROTOCOLS, CIPHER_SUITES, ASSET_TAGS, EXTENSIVE_CERTIFICATE_INFO

Exclude Fields - Exclude the specified parameters from the response.

For example- certificate.certhash, certificate.keySize, asset.netbiosName, asset.uuid.

For more information on include and exclude fields, refer to the API user guide. 

Certview Maximum API retry count

This field defines the number of times a TA can retry the API call after any error occurs. TA stops the data input run after the maximum retry count is exceeded. The checkpoint file stores the last-seen certificate details, like page number and certificate updated datetime, and starts the next run according to the cron schedule. It then picks up the page number and the certificate updated datetime from the last run and pulls the remaining data.

Event Types for CertView in Splunk

You can use default event types to search for CertView data pulled in Splunk. For more information, refer to Event Types for searching your apps data.