Prisma Cloud integrated with Qualys but data not visible in the Console

Prisma Cloud integrated with Qualys but data not visible in the Console

1754
Created On 01/23/23 09:54 AM - Last Modified 05/29/24 19:29 PM


Symptom


  • Customer successfully integrated Qualys with Prisma Cloud and followed the steps outline in our documentation.
  • Based on provided screenshots, integration was successful, unfortunately the customer can not see the data from Qualys within Prisma Cloud:
GUI Path: Settings > Integrations & Notifications > Edit Qualys Integration 
image.png

Investigation:
  • Customer run the following RQL’s:
config from cloud.resource where finding.type = 'Host Vulnerability'
1network from vpc.flow_record where dest.resource IN ( resource where finding.type = 'Host Vulnerability' )

config from cloud.resource where finding.source = 'Qualys'


Environment


  • Prisma Cloud SaaS
  • CSPM
  • Qualys


Cause


  • If you encounter this error in the Splunk backend logs:
“Registration must be completed before API requests will be served for this account:“
  • Then this is due to the fact that the registration must be complete before API being served.
  • Further detailed logs gathered from Splunk:
 <RESPONSE>  <CODE>2003</CODE> <TEXT>Registration must be completed before API requests will be served for this account: https://qualysguard.qg1.apps.qualys.in/fo/</TEXT>    </RESPONSE>  


Resolution


  • As per the Qualys user guide: Error : "Code 2003 - Registration must be completed before API requests will be served for this account."
  • The API request failed because nobody has yet accepted the EULA on behalf of the user’s subscription.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kGSJCA2&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail