Policy Compliance Reporting Service Settings

Configure the Policy Compliance Reporting Service (PCRS) settings to fetch the policy and the posture data from your subscribed Qualys PCRS account.

reporting_serviceThe PCRS settings allow you to configure the following options.

Setting

Description

Add additional field evidence

Pull the evidence data for the posture information records. By default, this field is disabled.

Do you want to truncate the evidence?

Truncate the evidence data. After you select the checkbox, only 100 lines are retained in the evidence data.

If there are policies with a large amount of evidence data, truncation should be enabled. Due to the data size, data fetching and ingesting for the policy ID with large amounts of evidence would be affected.

For example, if there is a policy id for which the evidence has 500 lines and if you enable the checkbox 'Do you want to truncate the evidence?' then only 100 lines are ingested for evidence data.

PCRS Maximum API retry count

Defines the number of times TA can retry the API call after any error occurs, except 429 Too Many Requests errors. TA skips the API call after the maximum retry count exceeds and proceeds to pick the next Policy IDs to pull the data.

Number of Policy Ids to use for Resolve Host Ids API (max 10)

Defines the number of policies considered for the subsequent Resolved Host API to pull the hosts associated to the respective policy Ids. The policy Ids are divided into multiple threads and data is pulled accordingly.

Host Ids Batch size for Posture Info Streaming API

Defines the number of Host Ids considered for the subsequent Posture Info Streaming API to pull the postures associated to the respective policy Ids.

PCRS Custom Policy Ids

Defines the Policy Ids if you want to pull or don't want to pull. If you want to provide more than one Policy Id, then provide comma separated values (for example, 1234, 4567).

You need to check include/exclude setting to provide the Custom Policy Ids.

  • If you select the include setting, then Custom Policy Id/Ids which is/are provided are pulled by TA.
  • If you select the exclude setting, then Custom Policy Id/Ids which is/are provided are not pulled, but the remaining Policy Ids are pulled by the TA.

PCRS custom policy operation (include/exclude)

Select option to include or exclude the Policy Ids. By default, the None option is selected. If the default option is retained, you cannot provide any Policy Ids in PCRS Custom Policy Ids

Number of threads for PCRS resolve host Ids API (Max 10)

Defines the number of threads to use to pull Host Ids for Policy Ids. The minimum value is 2, and the maximum value is 10.

Number of threads for PCRS posture streaming API (Max 10)

Defines the number of threads to use to pull the posture data. The minimum value is 2, and the maximum value is 10.

Event Types for Searching PCRS Findings in Splunk

You can use default event types to search for PCRS data pulled in the Splunk. For more information, refer to Event Types for searching your app's data.