Qualys integration error

Elastic Stack Elastic Agent
1

Hello,
Yesterday, I updated the Qualys integration, and now the integration has stopped working. I tried to read the request to the Qualys API in the "configs" tab of the integration, but it only shows this error:

image
image1243×457 39.7 KB

Is this error only of my cluster?

2

Hey,

This PR: [Fleet] Fix cloudflare template error by criamico · Pull Request #182645 · elastic/kibana · GitHub fixes the issue, but will be available in 8.14.1. Essentially, it seem to be how the escape_string function is not handled properly when the parameter is not set i.e., null or empty.

For qualys, integrations/packages/qualys_vmdr/data_stream/user_activity/agent/stream/cel.yml.hbs at main · elastic/integrations · GitHub it seems that escape_string is used in username, password, and initial_interval. Probably one of them is not defined, and hence causing this error.

3

Thank you, updating the cluster worked for the 'settings' section, but the integration is throwing the following error. It seems that the dates are not being sent correctly; is it a problem with the host where my agent is located?

[
  <?xml version="1.0" encoding="UTF-8" ?>
  <!DOCTYPE SIMPLE_RETURN SYSTEM "https://qualysapi.qg4.apps.qualys.com/api/2.0/simple_return.dtd">
  <SIMPLE_RETURN>
    <RESPONSE>
      <DATETIME>2024-06-17T06:13:06Z</DATETIME>
      <CODE>1905</CODE>
      <TEXT>parameter since_datetime has invalid value: 2024-06-16T06:13:05.598422609Z (unsupported date format)</TEXT>
    </RESPONSE>
  </SIMPLE_RETURN>
  ,
  Processor 'conditional' with tag 'fail_on_cel_error' failed with message 'CEL program returned an error. Skipping ingest pipeline execution.'
]

image
image1897×799 172 KB

error.code 400
error.id 400 Bad Request

4

There is a bugfix related to formatting of timestamp: qualys_vmdr - user_activity fixes by andrewkroh · Pull Request #10035 · elastic/integrations · GitHub

Please upgrade to this latest version of Qualys integration 3.2.1 to fix the issue. Thanks!