Prisma Cloud:Qualys 集成后无法找到结果
Symptom
-
按照文档中概述的步骤,Qualys 与 Prisma Cloud 集成。尽管集成成功,但在运行以下 RQL 时您无法看到来自 Qualys 的数据:
config from cloud.resource where finding.type = 'Host Vulnerability' network from vpc.flow_record where dest.resource IN ( resource where finding.type = 'Host Vulnerability' )
Environment
- Prisma Cloud 企业版 (SaaS)
- Qualys 集成
Cause
-
When resource is part of
[COMPUTE]and had findings , we will not display findings from external Findings such as Tenable , Qualys , AWS Inspector. Only compute findings are returned. In asset sidecar customer will see only Compute vulnerabilities ( as we are giving precedence to our in-house Compute system ). -
When the source is only
[CSPM]for a given resource , UAI makes API call toexternal_findingsto get the vulnerabilities -
When the source is only
[COMPUTE]for a given resource , UAI makes API call tocomputeto get the vulnerabilities -
When the source is shared
[CSPM],[COMPUTE]for a given resource , UAI makes API call tocomputeto get the vulnerabilities.
Resolution
- 如果 RQL 诸如 ?config from cloud.resource where finding.source = ? ?
(外部发现源可以是 Qualys、AWS Inspector、Tenable)没有显示任何漏洞。 - 检查 cloud.resource 中的 ?config where finding.Type = 'Host Vulnerability? ? 是否返回结果。
- 如果是,请检查资源是否是计算的一部分。
Additional Information
在此查看有关 Qualys 集成的文档。