Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
57 commits
Select commit Hold shift + click to select a range
fbfb672
Update opencanary
alaudazzi May 27, 2025
2202cdf
Update ping_federate
alaudazzi May 27, 2025
d1568af
Update pps
alaudazzi May 28, 2025
b4fa015
Update prisma_access
alaudazzi May 30, 2025
bc352c0
Update prisma_cloud
alaudazzi May 30, 2025
6665e84
Update proofpoint-itm
alaudazzi Jun 2, 2025
92fd7c6
Update proofpoint_on_demand
alaudazzi Jun 2, 2025
76121e1
Update qualys_vmdr
alaudazzi Jun 2, 2025
2ccf02f
Update qualys and sentinel_one_cloud_funnel
alaudazzi Jun 2, 2025
e50178f
Update servicenow
alaudazzi Jun 2, 2025
bf50f10
Update splunk
alaudazzi Jun 4, 2025
579ab1e
Update spycloud
alaudazzi Jun 4, 2025
305e92c
Update sublime_security
alaudazzi Jun 4, 2025
6f94f0f
Update symantec_endpoint_security
alaudazzi Jun 4, 2025
6436f88
Update teleport
alaudazzi Jun 4, 2025
7800852
Update tenable_io
alaudazzi Jun 4, 2025
ab8c72c
Update ti_crowdstrike
alaudazzi Jun 4, 2025
a8613aa
Update ti_eset
alaudazzi Jun 4, 2025
d865667
Update ti_rapid7_threat_command
alaudazzi Jun 4, 2025
ec144cf
Update ti_threatconnect
alaudazzi Jun 5, 2025
70d6366
Update ti_threatq
alaudazzi Jun 5, 2025
0f96e9d
Update trellix_edr_cloud
alaudazzi Jun 5, 2025
d71a6a1
Update trendmicro
alaudazzi Jun 5, 2025
b0008ad
Update wiz
alaudazzi Jun 5, 2025
2463cfd
Update zscaler_zia
alaudazzi Jun 5, 2025
ab749df
Merge branch 'main' into remove-duplicated-install-instruct
alaudazzi Jun 5, 2025
2a8084d
Update zscaler_zia
alaudazzi Jun 5, 2025
8a0bd56
Merge branch 'remove-duplicated-install-instruct' of github.com:elast…
alaudazzi Jun 5, 2025
b6da6aa
Update manifest and changelog
alaudazzi Jun 5, 2025
8ada671
Update packages/zscaler_zia/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
aa48b6d
Update packages/opencanary/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
bf4b3ff
Update packages/qualys_vmdr/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
136cb21
Update packages/ti_threatconnect/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
14c207a
Update packages/wiz/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
a33fbd0
Update packages/splunk/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
e44579b
Update packages/opencanary/docs/README.md
alaudazzi Jun 16, 2025
83540ef
Update packages/ti_threatq/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
4e2526d
Update packages/opencanary/changelog.yml
alaudazzi Jun 16, 2025
aa40dde
Update packages/tenable_io/_dev/build/docs/README.md
alaudazzi Jun 16, 2025
c1fff96
Integrate reviewer comments
alaudazzi Jun 16, 2025
89f946d
Integrate reviewer comments
alaudazzi Jun 16, 2025
d79a561
Integrate reviewer comments
alaudazzi Jun 16, 2025
5220bb1
Merge branch 'main' into remove-duplicated-install-instruct
alaudazzi Jun 16, 2025
e4987c8
Remove dead URL
alaudazzi Jun 16, 2025
f842043
Update manifest for ping_federate
alaudazzi Jun 18, 2025
338e660
Update manifest for qualys_vmdr
alaudazzi Jun 18, 2025
b0dfd15
Update manifest for teleport
alaudazzi Jun 18, 2025
9f9413d
Update manifest for tenable_io
alaudazzi Jun 18, 2025
246bb8c
Merge branch 'master' into remove-duplicated-install-instruct
efd6 Jun 18, 2025
5ef3f12
Update README
shmsr Jun 18, 2025
e32561b
ti_threatconnect: update transform
efd6 Jun 18, 2025
6c0cce8
Merge branch 'main' into remove-duplicated-install-instruct
alaudazzi Jun 18, 2025
2178a88
Update manifest for sentinel_one_cloud_funnel
alaudazzi Jun 18, 2025
28b5e6a
Update packages/prisma_cloud/_dev/build/docs/README.md
alaudazzi Jun 18, 2025
7cfde08
Update packages/proofpoint_itm/_dev/build/docs/README.md
alaudazzi Jun 18, 2025
6d3f25f
run elastic-package for prisma_cloud
alaudazzi Jun 18, 2025
d412438
Run elastic-package for proofpoint_itm
alaudazzi Jun 18, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update qualys_vmdr
  • Loading branch information
alaudazzi committed Jun 2, 2025
commit 76121e17fed955a2cf505adeabfb0c6787f5e285
50 changes: 16 additions & 34 deletions packages/qualys_vmdr/_dev/build/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,32 +24,14 @@ Starting from Qualys VMDR integration version 6.0, the `Asset Host Detection` da

## Requirements

- Elastic Agent must be installed.
- You can install only one Elastic Agent per host.
- Elastic Agent is required to stream data through the REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.

### Agentless Enabled Integration
### Agentless enabled integration
Comment thread
alaudazzi marked this conversation as resolved.
Resolved

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

### Installing and managing an Elastic Agent:

You have a few options for installing and managing an Elastic Agent:

### Install a Fleet-managed Elastic Agent (recommended):

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

### Install Elastic Agent in standalone mode (advanced users):

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

### Install Elastic Agent in a containerized environment:

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
### Agent-based installation

There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.

### Permissions

Expand Down Expand Up @@ -77,18 +59,17 @@ _Managers_, _Unit Managers_, _Scanners_, _Readers_ have permission to download v

## Setup

### To collect data through REST API, follow the below steps:
### Collect data through REST API

- Considering you already have a Qualys user account, to identify your Qualys platform and get the API URL, refer this [link](https://www.qualys.com/platform-identification/).
- Alternative way to get the API URL is to log in to your Qualys account and go to Help > About. You’ll find your URL under Security Operations Center (SOC).
Assuming that you already have a Qualys user account, to identify your Qualys platform and get the API URL, check the [Qualys documentation](https://www.qualys.com/platform-identification/).
Alternatively, to get the API URL log in to your Qualys account and go to **Help** > **About**. You’ll find your URL under **Security Operations Center (SOC)**.

### Enabling the integration in Elastic:
### Enable the integration in Elastic

1. In Kibana go to Management > Integrations
2. In "Search for integrations" search bar, type Qualys VMDR
3. Click on the "Qualys VMDR" integration from the search results.
4. Click on the Add Qualys VMDR Integration button to add the integration.
5. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details:
1. In Kibana navigate to **Management** > **Integrations**.
2. In the search top bar, type **Qualys VMDR**.
3. Select the **Qualys VMDR** integration and add it.
4. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details:
- username
- password
- url
Expand All @@ -110,12 +91,13 @@ _Managers_, _Unit Managers_, _Scanners_, _Readers_ have permission to download v
- url
- initial interval
- interval
5. Save the integration.

**NOTE**: By default, the input parameter is set to "action=list".
**NOTE**: By default, the input parameter is set to `action=list`.

## Data reference

### Asset Host Detection
### Asset host detection

This is the `Asset Host Detection` dataset.

Expand All @@ -125,7 +107,7 @@ This is the `Asset Host Detection` dataset.

{{fields "asset_host_detection"}}

### Knowledge Base
### Knowledge base

This is the `Knowledge Base` dataset.

Expand All @@ -135,7 +117,7 @@ This is the `Knowledge Base` dataset.

{{fields "knowledge_base"}}

### User Activity
### User activity

This is the `User Activity` dataset. It connects to an [API](
https://docs.qualys.com/en/vm/api/users/index.htm#t=activity%2Fexport_activity.htm)
Expand Down
50 changes: 16 additions & 34 deletions packages/qualys_vmdr/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,32 +24,14 @@ Starting from Qualys VMDR integration version 6.0, the `Asset Host Detection` da

## Requirements

- Elastic Agent must be installed.
- You can install only one Elastic Agent per host.
- Elastic Agent is required to stream data through the REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.

### Agentless Enabled Integration
### Agentless enabled integration

Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

### Installing and managing an Elastic Agent:

You have a few options for installing and managing an Elastic Agent:

### Install a Fleet-managed Elastic Agent (recommended):

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

### Install Elastic Agent in standalone mode (advanced users):

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

### Install Elastic Agent in a containerized environment:

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
### Agent-based installation

There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.

### Permissions

Expand Down Expand Up @@ -77,18 +59,17 @@ _Managers_, _Unit Managers_, _Scanners_, _Readers_ have permission to download v

## Setup

### To collect data through REST API, follow the below steps:
### Collect data through REST API

- Considering you already have a Qualys user account, to identify your Qualys platform and get the API URL, refer this [link](https://www.qualys.com/platform-identification/).
- Alternative way to get the API URL is to log in to your Qualys account and go to Help > About. You’ll find your URL under Security Operations Center (SOC).
Assuming that you already have a Qualys user account, to identify your Qualys platform and get the API URL, check the [Qualys documentation](https://www.qualys.com/platform-identification/).
Alternatively, to get the API URL log in to your Qualys account and go to **Help** > **About**. You’ll find your URL under **Security Operations Center (SOC)**.

### Enabling the integration in Elastic:
### Enable the integration in Elastic

1. In Kibana go to Management > Integrations
2. In "Search for integrations" search bar, type Qualys VMDR
3. Click on the "Qualys VMDR" integration from the search results.
4. Click on the Add Qualys VMDR Integration button to add the integration.
5. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details:
1. In Kibana navigate to **Management** > **Integrations**.
2. In the search top bar, type **Qualys VMDR**.
3. Select the **Qualys VMDR** integration and add it.
4. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details:
- username
- password
- url
Expand All @@ -110,12 +91,13 @@ _Managers_, _Unit Managers_, _Scanners_, _Readers_ have permission to download v
- url
- initial interval
- interval
5. Save the integration.

**NOTE**: By default, the input parameter is set to "action=list".
**NOTE**: By default, the input parameter is set to `action=list`.

## Data reference

### Asset Host Detection
### Asset host detection

This is the `Asset Host Detection` dataset.

Expand Down Expand Up @@ -599,7 +581,7 @@ An example event for `asset_host_detection` looks as following:
| vulnerability.title | | keyword |


### Knowledge Base
### Knowledge base

This is the `Knowledge Base` dataset.

Expand Down Expand Up @@ -790,7 +772,7 @@ An example event for `knowledge_base` looks as following:
| qualys_vmdr.knowledge_base.vuln_type | | keyword |


### User Activity
### User activity

This is the `User Activity` dataset. It connects to an [API](
https://docs.qualys.com/en/vm/api/users/index.htm#t=activity%2Fexport_activity.htm)
Expand Down