Prisma Cloud:Qualys 集成后无法找到结果

Prisma Cloud:Qualys 集成后无法找到结果

3111
Created On 04/04/24 11:56 AM - Last Modified 12/27/24 07:45 AM


Symptom


  • 按照文档中概述的步骤,Qualys 与 Prisma Cloud 集成。尽管集成成功,但在运行以下 RQL 时您无法看到来自 Qualys 的数据:

config from cloud.resource where finding.type = 'Host Vulnerability'

network from vpc.flow_record where dest.resource IN ( resource where finding.type = 'Host Vulnerability' )



Environment


  • Prisma Cloud 企业版 (SaaS)
  • Qualys 集成


Cause


  • When resource is part of [COMPUTE] and had findings , we will not display findings from external Findings such as Tenable , Qualys , AWS Inspector. Only compute findings are returned. In asset sidecar customer will see only Compute vulnerabilities ( as we are giving precedence to our in-house Compute system ).

  • When the source is only [CSPM] for a given resource , UAI makes API call to external_findings to get the vulnerabilities

  • When the source is only [COMPUTE] for a given resource , UAI makes API call to compute to get the vulnerabilities

  • When the source is shared[CSPM],[COMPUTE] for a given resource , UAI makes API call to compute to get the vulnerabilities.



Resolution


  1. 如果 RQL 诸如 ?config from cloud.resource where finding.source = ? ?
    (外部发现源可以是 Qualys、AWS Inspector、Tenable)没有显示任何漏洞。
  2. 检查 cloud.resource 中的 ?config where finding.Type = 'Host Vulnerability? ? 是否返回结果。
  3. 如果是,请检查资源是否是计算的一部分。


Additional Information


查看有关 Qualys 集成的文档。



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000CrIwCAK&lang=zh_CN&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language