Migrating from Qualys PC Result Integration to Qualys PCRS Test Results Integration
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-26-2023 09:31 PM
We are migrating from the Qualys PC Result Integration to the new "Tokyo" integrations
Qualys PCRS Policy Host Integration and Qualys PCRS Test Results Integration. And would like somr help.
1) For the current integrations we setup the Server URL, Username and Password via the Vulnerability Response->Administration->Setup Assistant->Scanner Integrations. For the new PCRS integrations, is the gateway_url in the Qualys Vulnerability Integration->Administration->Integration Instance the same value as the Server url in Setup Assistant?
2) Also, can the Username and password defined via the Setup Assistant be leveraged for the PCRS integration or do they need separate credentials?
3) Prior to running Qualys PCRS Policy Host Integration, the Qualys PC Policies, Qualys PC Policies Detail and Qualys PC Controls should be run first.
4) Currently we have separate Qualys PC Result integrations defined for each policy and leverage Qualys Host Tags to manage the volume of data received from Qualys. I am assuming we can configure a separate Qualys PCRS Test Results Integration for each policy and host tags like the Qualys PC Result Integrations?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-11-2023 10:07 AM - edited 07-11-2023 10:34 AM
Hi Ron,
1. The Gateway URLs can be found at the link below. In my setup I've used the one for our Platform URL. See the second table.
https://www.qualys.com/platform-identification/
2. I don't believe I had to update my service account credentials from the original setup.
3. Yes prior to running the PCRS integrations you would need test and test group data from the PC Policies, PC Policies Detail and PC Controls integrations.
4. From what I can tell in the API you can still pass Policy ID but there are no tag_set_include/exclude parameters that can be passed. See below.
- Page 737 for non-PCRS endpoint parameters where you're specifying host tags, etc. today
- Page 760 for specifying policy IDs for host ingest - you can still filter only specific Policy IDs here
- Page 763 for results API but there are limited parameters available
https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf
Keep in mind the streaming API should ingest data much faster so you may not need to slice up your data into so many jobs with it.
Hope you're able to get this setup!
Thank you,
Robert
