Skip to main content

Cyber Front - SCV - Integration with Qualys Cloud - Detection Analytics

  • Updated

Prerequisites

  • An available Cyber Front Integration Agent
  • Qualys Cloud Platform login credentials
    • Qualys Cloud Platform URL
    • Username
    • Password
  • The Integration Agent host must have access to Qualys Cloud Platform. 
  • Information about the Cyber Front Detection Analysis Feature.
  • A Cyber Front Platform user with an Admin role must be used to perform the following steps.

Minimum Required Permissions

The least-privileged user role and security roles are listed below.

  • UI Access and API Access must be selected.

  • "Endpoint Detection and Response Module" must be added.

  • Then, the role permissions must be configured according to the permissions below.

    • "EDR Incident View"

    • "EDR UI Access"

Solution

  • Log in to the Cyber Front Platform.
  • Click Integrations in the left navigation menu, and then click the Connect button for Qualys Cloud Platform.
  • Select an available integration agent in the Integration Agents step, and then click the Next button in the bottom-right corner.
  • Select the access protocol and provide the Qualys Cloud Platform login credentials in the Access step.

  • Review and adjust the Advanced Settings in the Access step.
    • Store Raw Logs is an option that helps you view which raw logs are validated for the performed actions.
      • Storage Size (GB) is the value specified in the Storage Size field that determines the maximum storage capacity that can be allocated on the integration agent for this integration.
      • Keep Non-validated Logs is an option that allows you to view raw, non-validated logs retrieved from the integration vendor. It is recommended that you enable this for troubleshooting purposes.
    • The Extract Raw Logs option sends raw log data to the Cyber Front Platform, allowing it to be used by the Cyber Front API. To enable this functionality, the Store Raw Logs option must also be turned on.
    • Log Limitation is a value that limits the number of logs retrieved in a query. It is recommended to use the default value.
    • Concurrent Simulation allows you to run detection analytics on multiple threats simultaneously.
    • Analysis Delay is an optional time setting, measured in seconds, used to slow down Cyber Front queries when needed, such as during a performance issue or an API rate limitation in the SIEM/EDR/XDR solution.
  • Click the Login button to verify that the provided information is correct.
  • The next and final step is Configurations.
    • Log Analysis
    • Alert Analysis

Log Analysis

Log Analysis is an automated validation process that correlates Cyber Front simulations with the logs captured by Qualys Cloud Platform.

The delay time and early time values must be configured based on your environment. These timing parameters ensure accurate analysis by properly handling scenarios such as delayed log ingestion or early log creation.

  • Log Analysis Interval defines when and which time interval is used in the Cyber Front query. 

    • Setting an early time may be required if there is an NTP (Network Time Protocol) issue in the log source.

      Setting a delay time is necessary to account for the difference between when a log is generated on the source and when it is indexed in Qualys Cloud Platform.

      Please note the following:

      • Entering a high value may impact Qualys Cloud Platform performance.

      • Entering a low value may lead to false-negative results (missing or incomplete logs in searches).

Alert Analysis (Optional)

Alert Analysis is used to validate the triggered Qualys Cloud Platform alerts generated by Cyber Front simulations.

  • Alert Analysis Interval defines when and which time interval is used in the Cyber Front alert query. 
    • Setting an early time may be required if there is an NTP (Network Time Protocol) issue.
    • Delay time is the duration of the triggered alerts and depends on the alert schedule.
    • Entering a low value may result in a false negative.
  • Click the Submit button to verify that the information provided is correct. Once all information is correct, the "You successfully finished Qualys Cloud Platform setup." message appears.

Related to