Qualys Technology Add-on missing host detection data

Applicability

Splunk Cloud Qualys Technology Add-on for Splunk TA-QualysCloudPlatform

Description

After installing the Qualys Technology Add-on for Splunk Cloud and configuring the app to ingest data, there appears to be significant discrepancies between the vulnerability data in Qualys and that available within the app via Splunk Cloud. For example, vulnerability count is significantly different as are the number of hosts being scanned.

Running the below search query returns less hosts than expected: 

index="<sec_qualys_scan>" sourcetype="qualys:hostDetection" HOST_ID=*

Investigation

TA-QualysCloudPlatform logs are visible in the _internal index and can be searched using the following spl query: 

index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"

The below search provides an overview of the API calls made by the app: 

index=_internal source="/opt/splunk/var/log/splunk/ta_QualysCloudPlatform.log"
("/api/2.0/fo/asset/host/vm/detection/" OR "/api/2.0/fo/knowledge_base/vuln/" OR
"/api/2.0/fo/compliance/posture/info/" OR "/qps/rest/3.0/search/was/finding")

The interest in Host Detection, specifically the /api/2.0/fo/asset/host/vm/detection/ API.

Resolution

Using the search queries provided in this article, errors were located in the ta_QualysCloudPlatform.log related to the Host Detection API call being made by the app: 

TA-QualysCloudPlatform (host_detection): 2023-02-08 05:32:47 PID=6663 [MainThread] ERROR: could not load API response. Reason: 'NoneType' object has no attribute 'replace'
host = sh-<hostname>.<splunkcloudstackid>.splunkcloud.comsource = /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.logsourcetype = ta_QualysCloudPlatform-9

TA-QualysCloudPlatform (host_detection): 2023-02-12 17:32:03 PID=26502 [MainThread] ERROR: Error during Fetching, Cleaning up and retrying

TA-QualysCloudPlatform (host_detection): 2023-02-12 17:32:03 PID=26502 [MainThread] ERROR: IOError in handling response and writing to file, None : The read operation timed out

Additional error messages found: 

TA-QualysCloudPlatform (policy_posture_info): 2023-02-13 02:36:51 PID=20569 [Thread-1] ERROR: Could not process RESPONSE element. Error: [Errno 32] Broken pipe | traceback - Traceback (most recent call last):
host = sh-<hostname>.<splunkcloudstackid>.splunkcloud.comsource = /opt/splunk/var/log/splunk/ta_QualysCloudPlatform.logsourcetype = ta_QualysCloudPlatform-9

Please be aware the Qualys Technology Add-on (TA) for Splunk application is not Splunk Supported. This application is Developer Supported: Apps and add-ons published by parties other than Splunk Inc. Any support or maintenance for these apps and add-ons is provided by the developer, whose contact information can be found on the download page. Splunkbase, Qualys Technology Add-on (TA) for Splunk

The App Development team confirmed this is an app defect found in app TA-QualysCloudPlatform version: 1.10.7. Upgrading the TA-QualysCloudPlatform app to version: 1.10.8 or newer, should resolve this issue. 

Related Links

Splunkbase, Qualys Technology Add-on (TA) for Splunk
Qualys App Documentation

Revision History

Revision	Publish Date	Comments
1.0	30-Sep-2026	Initial Release