Prisma Cloud integrated with Qualys but data not visible in the Console
1754
Created On 01/23/23 09:54 AM - Last Modified 05/29/24 19:29 PM
Symptom
- Customer successfully integrated Qualys with Prisma Cloud and followed the steps outline in our documentation.
- Based on provided screenshots, integration was successful, unfortunately the customer can not see the data from Qualys within Prisma Cloud:
Investigation:
- Customer run the following RQL’s:
config from cloud.resource where finding.type = 'Host Vulnerability' 1network from vpc.flow_record where dest.resource IN ( resource where finding.type = 'Host Vulnerability' ) config from cloud.resource where finding.source = 'Qualys'
- Customer confirmed that following steps were successfully based on our documentation: Integrate Prisma Cloud with Qualys.
Environment
- Prisma Cloud SaaS
- CSPM
- Qualys
Cause
- If you encounter this error in the Splunk backend logs:
“Registration must be completed before API requests will be served for this account:“
- Then this is due to the fact that the registration must be complete before API being served.
- Further detailed logs gathered from Splunk:
<RESPONSE> <CODE>2003</CODE> <TEXT>Registration must be completed before API requests will be served for this account: https://qualysguard.qg1.apps.qualys.in/fo/</TEXT> </RESPONSE>
Resolution
- As per the Qualys user guide: Error : "Code 2003 - Registration must be completed before API requests will be served for this account."
- The API request failed because nobody has yet accepted the EULA on behalf of the user’s subscription.