Executive Summary

A critical security issue in the Talend JobServer and Talend Runtime has been identified. This issue was resolved in later patches, which are already available. If the vulnerability is successfully exploited, an attacker could gain full remote code execution on the Talend JobServer and Talend Runtime servers.

This issue was discovered by Harpreet Singh (@TheCyb3rAlphaProfession), Security Researcher.

Affected Software

• All versions of Talend JobServer before TPS-6017 (8.0) or TPS-6018 (7.3).
• All versions of Talend Runtime before 8.0.1.R2026-01-RT or 7.3.1-R2026-01

Severity Rating

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), this issue is rated CRITICAL.

Vulnerability Details

CVE-2026-XXXX – A CVE is pending.

Severity: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)

A critical vulnerability has been found in the Talend JobServer and Talend Runtime that allows unauthenticated remote code execution

The attack vector for this vulnerability is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated for the Talend Jobserver by requiring TLS client authentication for the monitoring port. However, the patch will need to be applied to fully mitigate the vulnerability.
For Talend Runtime, the vulnerability can be mitigated by disabling the JobServer JMX monitoring port, which is disabled by default from the 8.0 R2024-07-RT patch.

Resolution

Recommendation

Upgrade at the earliest. The following table lists the patch versions addressing the vulnerability (CVE-2026-pending).

Always update to the latest version. Before you upgrade, check if a more recent release is available.

After upgrading or installing Qlik Sense Enterprise on Windows May 2022, users may not see all of their streams.

The streams appear only after an interaction or a click anywhere on the Hub.

This is caused by defect QB-10693, resolved in May 2022 Patch 4.

Environment

Qlik Sense Enterprise on Windows May 2022 

Workaround

To work around the issue without a patch:

1. Locate and open the file: C:\Program Files\Qlik\Sense\CapabilityService\capabilities.json
   
   
2. Modify the following line:  
   
   {"contentHash":"2ae4a99c9f17ab76e1eeb27bc4211874","originalClassName":"FeatureToggle","flag":"HUB_HIDE_EMPTY_STREAMS","enabled":true}
   
   Set it from true to false: 
   
   {"contentHash":"2ae4a99c9f17ab76e1eeb27bc4211874","originalClassName":"FeatureToggle","flag":"HUB_HIDE_EMPTY_STREAMS","enabled":false}
   
   
3. Save the file.
   
   If you have a multi node, these changes need to be applied on all nodes. 
   
   Note 2: As these are changes to a configuration file, they will be reverted to default when upgrading. The changes will need to be redone after patching or upgrading Qlik Sense.
   
   
4. Restart the Qlik Sense Dispatcher service AND the Qlik Sense Proxy Service 
   
   Note: If you have a multi node, all nodes need to be restarted. 

Fix

A fix is available in May 2022, patch 4.

Streams will show up (after a few seconds) without the need to click or interact with the hub.

Important NOTE about feature HUB_HIDE_EMPTY_STREAMS:

When you activate HUB_HIDE_EMPTY_STREAMS, you will have an expected delay before all streams appear.

To improve this delay, from Patch 4, you can add HUB_OPTIMIZED_SEARCH (needs to be added manually as a new flag). As of now, HUB_OPTIMIZED_SEARCH tag will be available in the upcoming August 2022 release and is not planned for any patches (yet)

If this delay (seconds) is not acceptable, you will need to disable this HUB_HIDE_EMPTY_STREAMS capability.

Cause 

This defect was introduced by a new capability service. 

Internal Investigation ID(s) 

QB-10693

The Qlik Sense Mobile app allows you to securely connect to your Qlik Sense Enterprise deployment from your supported mobile device. This is the process of configuring Qlik Sense to function with the mobile app on iPad  / iPhone.

This article applies to the Qlik Sense Mobile app used with Qlik Sense Enterprise on Windows. For information regarding the Qlik Cloud Mobile app, see Setting up Qlik Sense Mobile SaaS. 

Content:

• Pre-requirements (Client-side)
• Configuration (Server-side)
• Update the Host White List in the proxy
• Configuration (Client side)

Pre-requirements (Client-side)

See the requirements for your mobile app version on the official Qlik Online Help > Planning your Qlik Sense Enterprise deployment > System requirements for Qlik Sense Enterprise > Qlik Sense Mobile app

Configuration (Server-side)

Acquire a signed and trusted Certificate.

Out of the box, Qlik Sense is installed with HTTPS enabled on the hub and HTTP disabled. Due to iOS specific certificate requirements, a signed and trusted certificate is required when connecting from an iOS device. If using HTTPS, make sure to use a certificate issued by an Apple-approved Certification Authority.
Also check Qlik Sense Mobile on iOS: cannot open apps on the HUB  for issues related to Qlik Sense Mobile on iOS and certificates.

For testing purposes, it is possible to enable port 80.

(Optional) Enable HTTP (port 80).

1. Open the Qlik Sense Management Console and navigate to Proxies.
2. Select the Proxy you wish to use and click Edit Proxy.  
3. Check Allow HTTP 

Update the Host White List in the proxy 

If not already done, add an address to the White List:

1. In Qlik Management Console, go to CONFIGURE SYSTEM -> Virtual Proxies
2. Select the proxy and click Edit
3. Select Advanced in Properties list on the right pane
   
   

    

4. Scroll to Advanced section in the middle pane
5. Locate "Allow list"
   
   

    

6. Click "Add new value" and add the addresses being used when connecting to the Qlik Sense Hub from a client. See How to configure the WebSocket origin allow list and best practices for details. 
   
   

Generate the authentication link:

An authentication link is required for the Qlik Sense Mobile App.

1. Navigate to Virtual Proxies in the Qlik Sense Management Console and edit the proxy used for mobile App access
2. Enable the Client authentication link menu in the far right menu.
3. Generate the link.

NOTE: In the client authentication link host URI, you may need to remove the "/" from the end of the URL, such as http://10.76.193.52/ would be http://10.76.193.52 

Associate User access pass

Users connecting to Qlik Sense Enterprise need a valid license available. See the Qlik Sense Online Help for more information on how to assign available access types.
Qlik Sense Enterprise on Windows > Administer Qlik Sense Enterprise on Windows > Managing a Qlik Sense Enterprise on Windows site > Managing QMC resource > Managing licenses

• Managing professional access
• Managing analyzer access
• Managing user access
• Creating login access rules

Configuration (Client side)

1. Install Qlik Sense mobile app from AppStore.
2. Provide authentication link generated in QMC
   • Open the link from your device (this can be also done by going to the Hub, clicking on the menu icon at the top right and selecting "Client Authentication"), the installed application will be triggered automatically, and the configuration parameters will be applied.
   •  Enter user credentials for QS server

When setting up a Microsoft SQL Server Always On Availability Group (AG) along with a Windows Failover Cluster, are there any additional SQL Server–side configurations or Talend-specific database settings required to run Talend Job against a MSSQL Always On database?

Answer

Talend Job need be adapted at the JDBC connection level to ensure proper failover handling and connection resiliency, by setting relevant parameters in the Additional JDBC Parameters field.

Talend JDBC Configuration Requirement

Talend should connect to SQL Server using either the Availability Group Listener (AG Listener) DNS name or the Failover Cluster Instance (FCI) virtual network name, and include specific JDBC connection parameters.

Sample JDBC Connection URL:

jdbc:sqlserver://<AG_Listener_DNS_Name>:1433;
databaseName=<Database_Name>;
multiSubnetFailover=true;
loginTimeout=60

Replace and with your actual values. Unless otherwise configured, Port 1433 is the default SQL Server port.

Key Parameter Explanations

multiSubnetFailover=true
Enables fast reconnection after AG failover and is mandatory for multi-subnet or DR-enabled AG environments.

applicationIntent=ReadWrite (optional, usage-dependent)
Ensures write operations are always routed to the primary replica.
Valid values:
ReadWrite
ReadOnly

loginTimeout=60
Prevents premature Talend Job failures during transient failover or brief network interruptions.

Best Practice Recommendation

Before promoting any changes to the Production environment, it is essential to perform failover and reconnection stress tests in the DEV/QA environment. This will help to validate the behavior of Talend Job during:

• AG role switchovers
• Network interruptions
  
• Planned and unplanned failover scenarios

Related Content 

Talend JDBC connection parameters | Qlik Talend Help Center 

Microsoft JDBC driver support for Always On / HA-DR | learn.microsoft.com 

SQL Server JDBC connection properties | learn.microsoft.com 

Environment

• Talend Data Integration 

Navigating to the Software Update page of the Qlik Talend Administration Center UI leads to the following error:

Unexpected HTTP status 302' when accessing (https://talend-update.talend.com/nexus/service/local/status) redirect to (https://talend-update.talend.com/)").

This can affect any Patch Release of Qlik Talend Administration Center (TAC).

SoftwareUpdate

The Configuration page will reflect the error: 

Resolution

To resolve, change the Talend update URL (https://talend-update.talend.com/nexus) to https://talend-update.talend.com, removing /nexus from the path.

This is done in the Configuration page.

UpdateURLwithoutNexus

Cause

This issue began to appear after January 26th, 2026, at which point the URL backend was updated.  

The URL needs to be changed in the Qlik Talend Administration Center backend.

Environment

Talend Administration Center 

This article explains how to extract changes from a Change Store and store them in a QVD by using a load script in Qlik Analytics. 

The article also includes

• An app example with an incremental load script that will store new changes in a QVD
• Configuration instructions for the examples

Scenario

This example will create an analytics app for Vendor Reviews. The idea is that you, as a company, are working with multiple vendors. Once a quarter, you want to review these vendors.

The example is simplified, but it can be extended with additional data for real-world examples or for other “review” use cases like employee reviews, budget reviews, and so on.

The data model

The app’s data model is a single table “Vendors” that contains a Vendor ID, Vendor Name, and City:

Vendors:
Load * inline [
"Vendor ID","Vendor Name","City"
1,Dunder Mifflin,Ghent
2,Nuka Cola,Leuven
3,Octan, Brussels
4,Kitchen Table International,Antwerp
];

The Write Table

The Write Table contains two data model fields: Vendor ID and Vendor Name. They are both configured as primary keys to demonstrate how this can work for composite keys.

The Write Table is then extended with three editable columns:

• Quarter (Single select)
• Action required? (Single select)
• Comment (Manual user input)

Prerequisites

• A shared space
• A managed space (optional but advised for the tutorial)
• A connection to the Change-stores API to the Analytics REST connector in the shared space. A step-by-step guide on creating this connection is available in Extracting write table changes with the REST connector in Qlik Cloud.

Steps

1. Upload the attached .QVF file to a shared space
2. Open the private sheet Vendor Reviews
3. Click the Reload App (A) button and make sure data appears (B) in the top table
   

   
   

4. Go to Edit sheet (A) mode
5. Drag a Write Table Chart (B) on the top table, and choose the option Convert to: Write Table (C).
   
   This transforms the table into a Write Table with two data model columns Vendor ID and Vendor Name.
   
   
   

    

6. Go to the Data section in the Write Table’s Properties menu and add an editable column
   
   
   

    

7. This prompts you to define a primary key inside the table. Click Define (A) in the table and use both Vendor ID and Vendor Name as primary keys (B).
   
   You can also just use Vendor ID, but we want to show that this also supports composite primary keys.
   
   
   
   
   
   
8. Configure the editable column:
   
   
   • Title: Quarter
   • Show content: Single selection
   • Add options for Q1Y26 through Q4Y26.
     
     Tip! Also add an empty option by clicking the Add button without specifying a value.
     
     
     

      

9. Add another Editable column with the below configuration
   
   
   • Title: Action required
   • Type: Single select
   • Options:  Yes and No
     
     

     

10. Add another Editable column with the below configuration
    
    
    • Title: Review
    • Type: Single select
    • Options:  Yes and No
      
      
      
      
11. The Write Table is now set up.
    
    Go to the Write Table’s properties and locate the Change store (A) section. Copy the Change store ID (B).
    
    
    

     

12. Leave the Edit sheet mode. Then add changes for at least two records. Save those changes.
    
    
    

     

13. Go to the app’s load script editor and uncomment the second script section by first selecting all lines in the script section (CTRL+A or CMD+A) (A) and then clicking the comment button (B) in the toolbar.
    
    
    

     

14. Configure the settings in the CONFIGURATION part at the end of the load script
    
    
    

     

15. Update the load script with the IDs of the editable columns.
    
    The easiest solution to get these IDs is to test your connection. Make sure the connection URL is configured to use the /changes/tabular-views endpoint and uses the correct change store ID.
    
    
    

     

16. Copy and paste the example load script (for the editable columns only) and paste it in the app’s load script SQL Select statement that starts on line 159:
    
    
    

     

17. Replace the corresponding * symbols in the LOAD statement that starts on line 176:
    
    
    

     

18. Choose which records you want to track in your table by configuring the Exists Key on line 216.
    
    This key will be used to filter the “granularity” on which we want to store changes in the QVD and data model, as the load script will only load unique existing keys (line 235).
    
    
    • $(vExistsKeyFormula) is a pipe-separated list of the primary keys.
    • In this example, Quarter is added as an additional part of the exists key to keep track of changes by Quarter.
    • Optionally, this can be extended with createdBy and updatedAt to extend the granularity to every change made:
      
      
      

       

19. Reload the app and verify that the correct change store table is created in your data model. The second table in the sheet should also successfully show vendors and their reviews.

Environment

• Qlik Cloud Analytics

This article explains how to extract changes from a Change Store by using the Qlik Cloud Services connector in Qlik Automate and how to sync them to an Excel file.

While the example uses a Microsoft Excel file, it can easily be modified to create a CSV as well.

The article also includes:

• An automation example you can download and import (see Qlik Automate: How to import and export automations): Automation Example To Extract Change Store Data and Store in Microsoft Excel.json
• A Qlik app example with an inline load script with example data: Write Table Purchase Order Demo.qvf
• Example purchase order template Excel file: Purchase order template.xlsx
• Configuration instructions for the example

Content

• Prerequisites
• Installing the example app
• Create the automation and get the SharePoint metadata
• Configure the automation
• Running the automation from the sheet
• Bonus: overwriting an existing Excel file
• Bonus: Sending the Excel file as an email attachment

Prerequisites

You will need the following:

1. A working Write Table with a set of editable columns and some example values already stored in it.
   
   For more information on the Write Table chart, see Write Table | help.qlik.com.
   
   Here is an example of the Write Table that will be used in this article. It has the following configuration:
   
   
   
   

    

   • Week start is included in the primary key because the purchasing process (making the changes) happens on a weekly basis.

   • Product Name is included in the primary key to make sure it is always returned when retrieving changes through the Get Current Changes From Change Store block in Qlik Automate.
     
     Below is an example of the table in an app:
     
     

2. An Excel file that will be the template for purchase orders.
   
   
   • This must be stored in SharePoint or OneDrive.
     
     
   • This file must contain a sheet with an empty table on the sheet. Take note of the sheet name/id and the table name and id.
     
     An example template file is attached to this article.
     
     
     
     
3. A destination folder in Microsoft SharePoint or OneDrive where the new purchase order files should be created.
   
   Example of the SharePoint structure:
   
   

Installing the example app

Optionally, you can use the app that is included in this article. Follow these steps to install the app and configure the Write Table:

1. Import the app into your Qlik Cloud tenant.
2. Go to the Data Load Editor and do a manual reload.
3. Open the Inventory management sheet and go to edit mode.
4. Drag a Write Table Chart (A) on top of the Straight Table.
   
   
   
   
5. Select Convert to: Write Table (B).
   
   

   

6. Go to the Change store section in the Write Table's configuration panel and define a new primary key.
   
   
   

    

7. Select Product ID, Product Name, and Order Date as columns for the primary key, then click Save.
   

   
   

8. Add the following editable columns to the Write Table:
   
   
   1. To purchase: Manual user input
      
      
      
      
   2. Priority: Single selection: High, Low
      
      Tip! Add an empty option by clicking the + button without providing a value.
      
      
      
      
   3. Note: Manual user input
      
      
      
      
9. Leave the edit sheet mode and take note of the change store id for the change store that is linked to the Write Table.
   
   
   
   
10. First, make a selection in the app, then provide some example changes in the Write Table to use as example data to configure the automation:
    
    
    

     

Create the automation and get the SharePoint metadata

1. Create a new automation. See Qlik Automate for details.
2. Before the automation can be configured, SharePoint metadata is required that cannot be retrieved dynamically in the automation.
3. Get the SharePoint Drive Id. You need access to the Drive in the SharePoint Site on which the Excel template file is stored. To do this, add the List Drives From Site block from the Microsoft SharePoint connector. Connect your SharePoint account to this block.
4. Click the input field for the Site Id in the Inputs tab (A) on the List Drives From Site block and use the do lookup functionality (B) to search for the site (C).
   
   
   

    

   
   

    

5. Right-click the List Drives From Site block (A) to perform a Test Run (B) of the automation.
   
   Once completed, review the automation’s run history to retrieve the correct Drive Id from the List Drives From Site block to find the Drive Id of the drive you want to use.
   
   Store this id for later use.
   
   
   
   
   
   

   

6. Add a List Items On Drive block from the Microsoft SharePoint connector to the automation.
   
   This block will be used to retrieve the folder id for the destination folder in which the purchase orders should be created. Configure the block with the Drive Id from step 5.
   
   Specify root as the Item Id.
   
   
   
   
7. Run the automation manually to review the automation run’s history and retrieve the correct Item Id for your destination folder from the output of the List Items On Drive block.
   
   
   
   Tip! If your destination folder is nested in other folders, you will need to repeat this step until you have the item Id of the destination folder. Start with root as the Item Id and then replace it with each folder’s item id as you go towards the destination folder.
   
   
8. Right-click both SharePoint blocks and collapse (A) their loops.
   
   Then right-click them again to disable (B) them as they are no longer needed for the regular automation runs.
   
   But you might want to keep them inside the automation if you want to take this automation to a different SharePoint team or folder structure in the future. If you are certain you will not need another drive id or folder id for this automation, you can delete the blocks.
   
   

   
   
   

    

Configure the automation

1. Add an Inputs block and configure it with one required parameter weekStart. 
   
   This will be used to capture the weekStart date from the app when a user triggers the automation from the app.

   
   

2. Add six Variable blocks to the automation and add the following variables of type String:
   
   
   • driveId: store the Drive Id from step 5 in the previous section
   • folderId: store the folder’s item id of step 7 in the previous section
   • templateFileName: name of the Excel file template
   • destinationFileName: name of the purchase order file to create
   • sheetName: name of the sheet that contains the table
   • tableName: name of the table
     
     
3. Set values for the variables that correspond with your Excel file template. If you are using the example template from this article, you can supply the following values:
   
   
   • driveId: store the Drive Id from step 5 in the previous section
   • folderId: store the folder’s item id of step 7 in the previous section
   • templateFileName: Purchase order template.xlsx
   • destinationFileName: Purchase order_{$.inputs.weekStart}.xlsx
     
     Tip! if your date format uses slashes, it will not work for the Excel file name, as Excel will create directories. Instead, use a different date format, such as MM-DD-YYYY or MM_DD_YYYY.
     
     
     
     
   • sheetName: Purchase order
   • tableName: Products
     
     

4. Add an Open File block from the Cloud Storage connector and configure it as follows:
   
   
   • Connector: Microsoft SharePoint
   • Path: templateFileName variable
   • Drive Id: driveId variable.
     
     
     

      

5. Add a Copy File block from the Cloud Storage connector.
   
   This block will copy the template Excel File and create a new empty Excel file to create the purchase order.
   
   Configure the block as follows:
   
   
   • Source File: select the “Open File on Microsoft SharePoint …” block
   • Destination connector: Microsoft SharePoint
   • Destination Path: folder path + / + destinationFileName variable
   • Drive Id: driveId variable
     
     
     

      

6. Add a List Items On Drive block from the Microsoft SharePoint connector.
   
   This block will be used to get the Item Id for the file created by the Copy File block.
   
   Configure it as follows:
   
   
   • Drive Id: driveId variable
   • Item Id: folderId variable
     
     Tip! Right-click on the List Items On Drive block and choose Collapse loop. This saves space in the automation and makes it more readable.
     
     
     
     
7. Perform a manual run of the automation to verify that the destination Excel file is created and is returned by the List Items On Drive block.
   
   
8. Add a Lookup Item In List block from the Lists blocks section.
   
   This block will be used to retrieve the item id of the file created by the Copy File block (because this id is not returned by the Copy File block).
   
   Configure the block as follows:
   
   
   • List: full output from List Items On Drive 2 (A)
   • Conditions:
     
     
     1. Click the first input box (Property from) in the Condition parameter (B) and select the name parameter (C).
        
        
        
        
     2. Set the next input field (operator) to equals (D).
        
        
        

         

     3. Set the third one (Value) to the destinationFileName (E) variable.
        
        

9. Add a Create Workbook Session block from the Microsoft Excel connector and configure it with the output from the Lookup Item In List block.
   
   
   
   
10. Add a List Current Changes From Change Store block from the Qlik Cloud Services connector.
    
    This block will return all saved changes from the change store.
    
    Configure the Store Id parameter with the write table’s change store id.
    
    

    

11. Add a Filter List block. This block will be used to filter orders for the correct week.
    
    Configure it as follows:
    
    
    • List: output of the List Current Changes From Change Store block
    • Conditions:
      
      
      • Property from: the Order Date (A) returned by the List Current Changes From Change Store block.
        
        Tip! Make sure this field is part of your primary key so it is included in the change data from the change store.
        
        
        

         

      • Operator: equals

      • Value: the weekStart input from the Inputs block
        
        

        

12. Add an Update Rows In Worksheet block from the Microsoft Excel connector.
    
    This block will only be used to update a single cell in the Excel template with the date of the Week Start.
    
    If your Order form does not have such a value, you can ignore this step.
    
    If it has multiple of these values, then you can repeat it for each of them.
    
    Configure the block as follows:
    
    
    • Drive Id: Drive Id from the “Parent Reference” from the Lookup Item In List block
    • Item Id: Id from the Lookup Item In List block
    • Worksheet Name: Sheet Name variable
    • Start Cell: Coordinate of the Excel cell that needs to be updated. In the example template, this is G2.
    • End Cell: Same coordinate as the Start Cell since we are only updating a single cell.
    • Values: The weekStart input from the Inputs block. Since it will only update a single cell, there is no need to create an array as described in the help text.
      
      

      

13. Add a Loop Batch block.
    
    This block will divide the output from the Filter List block across multiple batches that can be added to Excel batch by batch.
    
    Configure the block as follows:
    
    
    • Loop over items of list: Filter List block
    • Amount of items per batch: 100
      
      

14. Add a Variable block inside the Batch Loop block.
    
    Create a new variable RowsString of type string.
    
    This variable will be used to build a string containing the changes in a format that is accepted by the Microsoft Excel connector.
    
    Add the following operations in the variable block:
    
    
    • Empty RowsString: this makes sure that on every new batch, the variable is emptied.
    • Append to RowsString: this will add the first text value to the string. Configure this to a single square bracket [.
      
      

      

15. Add a Loop block.
    
    This block will iterate over all the changes in the current batch.
    
    Configure it as follows:
    
    Loop over items of list: Loop Batch > Batch
    
    

    

    Tip! Perform a manual run of the automation to make sure there are example values in the Loop block.
    
    
16. Add a Get User block from the Qlik Cloud Services connector inside the loop of the Loop block.
    
    This block will be used to retrieve the user information for the updatedBy parameter in each change.
    
    Configure it to use the updatedBy parameter as input for the User Id parameter.
    
    
    
    
17. Add a Variable block to the Get User block and configure it to use the RowsString variable.
    
    Add an Append to RowsString operation and configure the Value to be of this format [“value1”,“value2”,…] where every item in this list corresponds with a value from the change that should be stored in the Excel file.
    
    
    1. This string should be built value by value.
       
       Start by typing [“ and then click to add the first value Product ID (A)
       
       

       

       
       

        

    2. Add another double quote, a comma, and a new double quote (",") for the next value:
       
       

       

    3. Repeat steps a and b to add all the values.
       
       Finally, add the user’s name from the Get User block as the final value.
       
       Optionally, this can also be another indicator, such as an email address. Finish the operation with another square bracket and a trailing comma ("],).
       
       
       

        

18. Add an Add Rows To Table (Batch) block from the Microsoft Excel connector after the loop from the Loop block.
    
    This block will be used to update the Excel file with the generated string that represents the current batch of changes.
    
    Configure the block as follows:
    
    
    • Drive Id: Drive Id from the “Parent Reference” from the Lookup Item In List block
    • Item Id: Id from the Lookup Item In List block
    • Worksheet: Sheet Name variable
    • Table Id: Table Name variable
    • Rows: This will be the Rows String variable, but it is not fully ready yet and needs some modifications:
      
      
      1. Add the Rows String variable
         
         

         

      2. Click the field mapping to the variable and choose Add formula. This will open the formula picker.
         
         

         

      3. Search for the Right trim formula.

         
         

          

      4. Configure the Character to trim parameter to a single comma.

         

      5. Type a single square bracket after the field mapping in the Rows input field:

         
         

          

         
         

          

19. Add a Close Workbook Session block from the Microsoft Excel connector at the end of the automation after the loop from the Loop Batch block.
    
    Configure the block as follows:
    
    
    • Drive Id: Drive Id from the Parent Reference from the Lookup Item In List block
    • Item Id: Id from the Lookup Item In List block
    • Session Id: Id from the output of the Create Workbook Session block
      
      
      

       

20. Run the automation manually and review the generated Excel file to make sure the table in the order form is correctly populated.
    
    
    
    
    

     

Running the automation from the sheet

The automation is now configured and can be run manually. But ideally, a user can run it from within the Qlik Sense app whenever they are finished with creating orders through the Write Table.

This article will only cover the button’s configuration in a sheet. A step-by-step guide on configuring the button object to run automations is available in How to run an automation with custom parameters through the Qlik Sense button.

1. Add a Button object to the sheet that contains the Write Table, set the button's action to 'Execute automation', and configure the automation.
   
   Tip! The automation selector in the button object only returns the first 100 automations. If your automation is not shown, you might need to manually copy and paste the automation id from the automation URL.
   
   
2. Add a parameter for the weekStart input from the automation's Inputs block.
   
   Then configure it to use the GetFieldSelections formula for the [Order Date] field (this is used as Week start in the Write Table).
   
   
   

    

3. Select a date in the app and click the button to run the automation and ensure that the correct date is received by the Inputs block:
   
   
   

    

   
   

    

Bonus: overwriting an existing Excel file

The Copy File block will fail when there already exists an Excel file with the same name. Depending on the use case, that might be the right behavior or you might want to overwrite the file.
The overwrite process explained below will delete the existing file and then create a new file.

1. Go to the automation and disconnect the Open File on Microsoft SharePoint block from the  Variable - tableName block.
   
   
2. Search for the Check If File Exists block from the Cloud Storage connector and connect it to the Variable - tableName block.
   
   Configure the block as follows:
   
   
   • Connector: Microsoft SharePoint
   • Path: folder path + / + destinationFileName variable (this should be the same path as the one configured in the Copy File block)
   • Drive Id: driveId variable
     
     
     
     

3. Add a Condition block to the automation and configure it to evaluate the output from the Check If File Exists block.
   
   This block will return a Boolean (true or false) result. If it is true, the file exists.
   
   Configure the Condition block to evaluate that output using the Boolean 'is true' operator:
   
   

4. Add a Delete File block from the Cloud Storage connector to the 'Yes' part of the Condition block. This will then only be executed when a file already exists, and will then delete the file. Configure the block as follows:
   
   
   • Connector: Microsoft SharePoint
   • Path: folder path + / + destinationFileName variable (this should be the same path as the one configured in the Copy File block)
   • Drive Id: driveId variable
     
     
     
     
5. Collapse the 'No' part of the Condition block as this will not be used (when there is no file, the automation can continue and copy the template to create a new file). Right-click on the Condition block and select the 'Hide NO Condition' option.
   
   
   
   

   
   

6. Reconnect the Open File block (and the other attached blocks) to the Condition block.
   
   

   

7. Perform two runs of the automation for the same date (weekStart) and ensure the original file is deleted and then recreated.
   
   
   

    

   
   
   

Bonus: Sending the Excel file as an email attachment

Qlik Automate can also be used to share the purchase order with your purchasing team. This can be built in the same automation or in a separate automation. Below are the steps to add this to the same automation.

1. Add an Open File block from the Cloud Storage connector at the end of the automation.
   
   Configure it as follows:
   
   
   • Connector: Microsoft SharePoint
   • Path: folder path + / + destinationFileName variable
   • Drive Id: driveId variable
     
     
     

      

2. Add a Send Mail With Attachments block from the Microsoft Outlook 365 connector.
   
   This block will be used to send the Excel file as an email attachment to one or more recipients.
   
   Configure the block as follows:
   
   
   • To: one or more email addresses for the recipients of the purchase order
   • Subject: Purchase order { $.inputs.weekStart }
   • Type: text
   • Content Body: <your email body>
   • Attachments:
     
     
     1. Click the 'Add attachment' button
     2. Specify the output from the Open File 2 block
        
        
        
        

Tip! Update the button label to make it clear to users of your app that clicking it will also send the purchase order.

As an alternative, it is also possible to add these blocks to a new automation that is triggered from a second button.
 

This template was updated on December 4th, 2025 to replace the original installer and API key rotator with a new, unified deployer automation. Please disable or delete any existing installers, and create a new automation, picking the Qlik Cloud monitoring app deployer template from the App installers category.

Installing, upgrading, and managing the Qlik Cloud Monitoring Apps has just gotten a whole lot easier! With a single Qlik Automate template, you can now install and update the apps on a schedule with a set-and-forget installer using an out-of-the-box Qlik Automate template. It can also handle API key rotation required for the data connection, ensuring the data connection is always operational.

Some monitoring apps are designed for specific Qlik Cloud subscription types. Refer to the compatibility matrix within the Qlik Cloud Monitoring Apps repository.

'Qlik Cloud Monitoring Apps deployer' template overview

This automation template is a set-and-forget template for managing the Qlik Cloud Monitoring Applications, including but not limited to the App Analyzer, Entitlement Analyzer, Reload Analyzer, and Access Evaluator applications. Leverage this automation template to quickly and easily install and update these or a subset of these applications with all their dependencies. The applications themselves are community-supported; and, they are provided through Qlik's Open-Source Software (OSS) GitHub and thus are subject to Qlik's open-source guidelines and policies.

For more information, refer to the GitHub repository.

Features

• Can install/upgrade all or select apps.
• Can create or leverage existing spaces.
• Programmatically verified prerequisite settings, roles, and entitlements, notifying the user during the process if changes in configuration are required, and why.
• Installs latest versions of specified applications from Qlik’s OSS GitHub.
• Creates required API key.
• Creates required analytics data connection.
• Creates a daily reload schedule.
• Reload applications post-install.
• Tags apps appropriately to track which are installed and their respective versions.
• Supports both user and capacity-based subscriptions.

Configuration:

Update just the configuration area to define how the automation runs, then test run, and set it on a weekly or monthly schedule as desired.

Configure the run mode of the template using 7 variable blocks

Users should review the following variables:

1. configuredMonitoringApps: contains the list of the monitoring applications which will be installed and maintained. Delete any applications not required before running (default: all apps listed).
2. refreshConnectorCredentials: determines whether the monitoring application REST connection and associated API key will be regenerated every run (default: true).
3. reloadNow: determines whether apps are reloaded immediately following updates (default: true).
4. reloadScheduleHour: determines at which hour of the day the apps reload at for the daily schedule in UTC timezone (default: 06)
5. sharedSpaceName: defines the name of the shared space used to import the apps into prior to publishing. If the space doesn't exist, it'll be created. If the space exists, the user will be added to it with the required permissions (default: Monitoring - staging).
6. managedSpaceName: defines the name of the managed space the apps are published into for consumption/ alerts/ subscription use.If the space doesn't exist, it'll be created. If the space exists, the user will be added to it with the required permissions (default: Monitoring).
7. versionsToKeep: determines how many versions of each staged app is kept in the shared space. If set to 0, apps are deleted after publishing. If a positive integer value other than 0, that many apps will be kept for each monitoring app deployed (default: 0).

App management:

If the monitoring applications have been installed manually (i.e., not through this automation), then they will not be detected as existing. The automation will install new copies side-by-side. Any subsequent executions of the automation will detect the newly installed monitoring applications and check their versions, etc. This is due to the fact that the applications are tagged with "QCMA - {appName}" and "QCMA - {version}" during the installation process through the automation. Manually installed applications will not have these tags and therefore will not be detected.

FAQ

Q: Can I re-run the installer to check if any of the monitoring applications are able to be upgraded to a later version?

A: Yes. The automation will update any managed apps that don't match the repository's manifest version.

Q: What if multiple people install monitoring applications in different spaces?

A: The template scopes the application's installation process to a managed space. It will scope the API key name to `QCMA – {spaceId}` of that managed space. This allows the template to install/update the monitoring applications across spaces and across users. If one user installs an application to “Space A” and then another user installs a different monitoring application to “Space A”, the template will see that a data connection and associated API key (in this case from another user) exists for that space already. It will install the application leveraging those pre-existing assets.

Q: What if a new monitoring application is released? Will the template provide the ability to install that application as well?

A: Yes, but an update of the template from the template picker will be required, since the applications are hard coded into the template. The automation will begin to fail with a notification an update is needed once a new version is available.

Q:I have updated my application, but I noticed that it did not preserve the history. Why is that?

A: Each upgrade may generate a new set of QVDs if the data models for the applications have changed due to bug fixes, updates, new features, etc. The history is preserved in the prior versions of the application’s QVDs, so the data is never deleted and can be loaded into the older version. 

A replication task fails with a start_job_timeout error, and the task logs showthe  following messages:

[SOURCE_UNLOAD   ]E: An FATAL_ERROR error occurred unloading dataset: .0FI_ACDOCA_20  (custom_endpoint_util.c:1155)
[SOURCE_UNLOAD   ]E:  Timout: exceeded the Start Job Timeout limit of 2400 sec. [1024720] (custom_endpoint_unload.c:258)
[SOURCE_UNLOAD   ]E:  Failed during unload [1024720]  (custom_endpoint_unload.c:442)

Resolution

We recommend running the extractor directly in RSA3 in SAP to measure how long it takes to start.

Based on the measured time, adjust the value of the internal parameter start_job_timeout.

The value should be at least 20% higher than the time SAP takes to start.

Cause

Reviewing the endpoint server logs (/data/endpoint_server/data/logs directory) reveals that the job timeout is configured as 2400 seconds: [sourceunload ] [INFO ] [] start_job_timeout=2400

The error occurrs because the job did not start within the configured timeout.

When the task attempted to start the SAP Extractor, SAP did not return the “start data extraction” response within 2400 seconds (40 minutes), causing the timeout.

This may happen for extractors with large datasets, such as 0FI_ACDOCA_20, where the initialization on the SAP side will take a long while. 

Environment

• Qlik Talend Cloud Data Integration

The following issue is observed in a replication from a SAP Hana source to a Snowflake target:

In the source table, all columns are defined as NOT NULL with default values.

However, in the replication project, specifically during Change Data Capture, Null Values are sent to the CT table created as part of Store changes. This is observed when Delete Operations are performed in the source.

In this example, the Register task of the Pipeline Project reads data from the Replication Task Target [The data available in Snowflake storage]. When the Storage task is run, the task fails with NULL result in a non-nullable column.

Resolution

When a DELETE operation is performed in SAP HANA, it removes the entire row from the table and stores only the Primary Key values in the transaction logs.

Operation type = DELETE
Default values are not available and not applied.

As a result, we can only see values for the primary key columns, and the remaining columns contain the null value in the Snowflake Target (__ct table).

To overcome this issue, please try the following workaround:

1. In the Replicate Project, apply a Global Rule Transformation to handle Null Value being populated in Snowflake.
   
   This is done through Add Transformation > Replace Column Value
   

   1. In the Transformation scope step:

      • Source schema: %
      • Source datasets: %
      • Column name is like: %
      • Where data is: UNSPECIFIED
      • Where column key attribute is: Not a key
      • Where column nullability is: Not nullable
        
        
        
        
   2. In the Transformation action step
      
      
      • Replace target value with: $IFNULL(${Q_D_COLUMN_DATA},0)
        
        
        
        

2. Prepare and run the job

3. Go to Snowflake and check the __CT table entry to verify that there are no more null values for non-primary key columns
   
   

4. In the Pipeline Project, use the Register task to load data from the Replication Task

5. Data will now successfully replicate in the storage without NULL values

Environment

• Qlik Talend Cloud Data Integration

A Qlik Replicate task using the SAP OData source endpoint fails with the error:

Error: Http Connection failed with status 500 Internal Server Error

Resolution

Change the SAP OData endpoint by setting Max records per request (records) to 25000.

1. Open your SAP OData endpoint
2. Switch to the Advanced tab
3. Set Max records per request (records) to 25000 
   
   

Internal Investigation ID

SUPPORT-7127

Environment

• Qlik Replicate

The Legacy Support portal has been discontinued as per Decommissioning the legacy support portal (support.qlik.com) January 23rd, 2026 .

How can I see all my legacy Qlik serial numbers or licenses?

To get an overview of your legacy serial number, contact Qlik Support by starting a chat.

Qlik Talend Data Stewardship R2025-02 keeps on loading and does not open up in Talend Management Console.

Resolution

Patch fix

Apply the latest Patch_20260105_TPS-6013_v2-8.0.1-.zip or latter version of patch 

TCP stack tunning 

##sysctl
sudo vi /etc/sysctl.conf
#add the following lines 
net.ipv4.tcp_keepalive_time=200
net.ipv4.tcp_keepalive_intvl=75
net.ipv4.tcp_keepalive_probes=5
net.ipv4.tcp_retries2=5

sudo sysctl -p #activate 

MTU change (avoid TCP traffic re-transmission)

temp change  without rebooting : 

sudo ip link set dev eth0  mtu 1280

Persist on os: 

sudo vi /etc/sysconfig/network-scripts/ifcfg-eth0
MTU=1280

network_mtu.html | docs.aws.amazon.com

Explanation on the Linux  tcp tunning parameters

These sysctl settings are primarily used to make your server more aggressive at detecting and closing "dead" or "hung" network connections. By default, Linux settings are very conservative, which can lead to resources being tied up by connections that are no longer active.

Here is a breakdown of what these specific changes do and why they are beneficial.

TCP Keepalive Settings 

The first three parameters control how the system checks if a connection is still alive when no data is being sent (the "idle" state).

The Benefit: In a standard Linux setup, it can take over 2 hours to realize a peer has crashed. With your settings, a dead connection will be detected and cleared in roughly 20 minutes (200 + (75* 5) = 575 seconds). This prevents "ghost" connections from filling up your connection tables and wasting memory. 
 

TCP Retries

The Benefit: The default value is usually 15, which can lead to a connection hanging for 13 to 30 minutes during a network partition or server failure because the "backoff" timer doubles with each retry. By dropping this to 5, the connection will "fail fast" (usually within a few minutes).
 
This is excellent for high-availability systems where you want the application to realize there is a network issue quickly so it can failover to a backup or return an error to the user immediately rather than leaving them in a loading state.
 

Use Cases for These Settings

Microservices: To ensure fast failover and prevent a "cascade" of waiting services in a distributed system.

If These changes are not permanent until you add them to /etc/sysctl.conf. Running the command with -w only applies them until the next reboot.

Cause

There are 2 major factors contributing to this issue

1. invalid_grant error caused by current design defects

   ERROR [http-nio-19999-exec-2] g.c.s.Oauth2RestClientRequestInterceptor : #1# Message: '[invalid_grant] ', CauseMessage: '[invalid_grant] ', LocalizedMessage: '[invalid_grant] '

2. EC2 Linux sysctl tcp stack default setting not ideal for clean the hang connections.

Environment

Talend Data Stewardship 

1. Take a backup of the app and data associated with the app:
   1. Export the existing Operations Monitor app via the QMC (Apps > More actions > Export). Backup to a safe location.
   2. Backup the QVD files in the Central Node Log directory (C:\ProgramData\Qlik\Sense\Log by default)
   3. Verify you have an Operations Monitor QVF file in the DefaultApps section of the Qlik installation directory (C:\ProgramData\Qlik\Sense\Repository\DefaultApps by default). Ask support for a copy for your version of Qlik Sense if you cannot locate the file.
   4. Write down any reload tasks associated with the app so that you can restore them later
   5. Write down the original owner of the app (should be the internal repository user, INTERNAL\sa_repository)
2. Remove the Operations Monitor App and associated data files:
   1. Delete the Operations Monitor app via the QMC (Apps > Delete). This removes both the app and associated reload tasks.
   2. Delete the QVD files associated with the Operations Monitor App (governance*.qvd) in the Central Node Log directory (C:\ProgramData\Qlik\Sense\Log by default)
3. Restart all Qlik Sense services.
4. Re-import the Operations Monitor App from the installation directory:
   1. Locate the default Operations Monitor app in the DefaultApps section of the Qlik installation directory (C:\ProgramData\Qlik\Sense\Repository\DefaultApps by default)
   2. Import the app via the QMC (Apps > Import)
   3. Change ownership of the app to the same user as before (should have been the internal repository user, INTERNAL\sa_repository)
   4. Recreate any reload tasks noted from step 1
5. Reload the app, and verify the app works as expected.

To point Qlik Replicate at an AG Secondary Replicate instead of the primary, follow these steps;

1. Create the publication/articles/filters the same way Replicate would or enable MS-CDC per the User's Guide for all the tables in the task.
2. Set the SQL Server Source Endpoint internal parameter ignoreMsReplicationEnablement so that Replicate will not check for publication/articles.
3. Set the SQL Server Source Endpoint internal parameter safeguardPolicyDesignator to ‘None’ so that Replicate will not try to create a transaction on the source.
4. Set the SQL Server Source Endpoint internal parameter AlwaysOnSharedSynchedBackupIsEnabled so that Replicate will not try to connect to all the AG Replicas to read the MSDB.
5. Set the SQL Server Source Endpoint ‘Change processing mode (read changes from):’ to ‘Backup Logs Only’
6. As part of their transaction log backup maintenance plan, it's needed to run a script to merge the MSDB entries across all the Replicas. This may not be necessary if the backup is done on the secondary Replica that we will be attached to. The backups should also be placed on a share the Replicate can get access to. Optionally use 'Replicate has file-level access' if the backups are not encrypted and Replicate has direct access to them.
7. It is needed to create the LSN/Numeric conversion scalar functions on the source database on the secondary.

Limitations include:

• Can read from backups only.
• Manual setup of publications/articles or MS CDC.
• Manual creation of supporting LSN conversion functions

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

If you want to submit a new idea or improvement request for Qlik's products, our Ideas section in the Qlik Community is open to all registered customers. The Ideation portal covers ideas and suggestions for all Qlik Products, such as Qlik Cloud Analytics, Qlik Sense Enterprise on Windows, Qlik Talend, Qlik Stitch, and more.

Content:

• Where to find Qlik Ideation
• How to submit an Idea on the Ideation

Ideas are qualified and prioritized based on their value to improving and enhancing the Qlik product. For a successful request, please consider including a strong business case on why you think the change would be beneficial, including:

• Functionality: How does the product work now? How would you like it to work in the future? 
• Motivation: Why is the change important for your business?
• Importance: What is the impact if the feature request is not approved?
• Benefits: What is the impact if the feature request is implemented?

Where to find Qlik Ideation

1. Go to the Qlik Community
2. Log in!
3. After logging in, navigate to Ideation

   A valid Qlik ID (log in to the Community) is required.

   1. You can navigate there manually from (a) Ideation
   2. And (b) Browse and Suggest
      
      
      
      
4. Scroll down to locate the Ideation Landing Page / App
   
   
   
   For more information on the Ideation Dashboard and its functionalities, see About Ideation.
   
   
   

How to submit an Idea on the Ideation

Before you get started, review Ideation Guidelines: How to Submit an Idea for submission guidelines and eligibility information.

1. Go to the Ideas Site  

   A valid Qlik ID (log in to the Community) is required.

2. Click the Suggest Features card
    
   
   
   
3. Provide us with as much detail as possible, including a descriptive subject and description.
4. Choose the appropriate Product Area.
5. And click Submit request.
   
   

Ideas and Improvement requests are reviewed by our product teams. While we strive to provide answers, we cannot guarantee a specific response time.  

Related Content:

Ideation on Community  
Ideation Platform Updates
Ideation Guidelines: How to Submit an Idea

When you run a Job from Talend Studio (any version) to a remote engine (all versions), the metric (flow) information, like n Row(s), does not transfer back to Talend Studio.

Cause

The remote run/debug from Studio feature uses direct TCP communication on JobServer ports. If you do not open port 8558, the information will not transfer back to Talend Studio.

To check whether port 8558 is open, look in the <RemoteEngineInstallationDirectory>/etc/org.talend.remote.jobserver.server.cfg configuration file.

# used to launch talend commands
org.talend.remote.jobserver.server.TalendJobServer.COMMAND_SERVER_PORT=8003

# used for the file transfer
org.talend.remote.jobserver.server.TalendJobServer.FILE_SERVER_PORT=8004

# used for monitoring the servers state
org.talend.remote.jobserver.server.TalendJobServer.MONITORING_PORT=8891

# used for the execution of process messages publisher, 8558 by default
org.talend.remote.jobserver.server.TalendJobServer.PROCESS_MESSAGE_PORT=8558

Resolution

Ensure port 8558 is open. This transfers the state and trace of the run from the Talend Remote Engine for Jobs being executed remotely.

Security of Qlik Sense Enterprise on Windows can be approached in the below discrete areas. All these areas provide different options for increasing security in a deployment, and thereby mitigating vulnerabilities and protecting against attackers. 

Content:

• 1. Authentication
• 2. Authorization
• Security Rules
• Section Access
• 3. Operating System Hardening
• Step 1: Disabling protocols and ciphers
• Step 2: Firewalls
• Step 3: Service Account Permission
• Step 4: Anti-Virus
• Step 5 (Optional): FIPS
• 4. PostgreSQL Hardening
• 5. Generalized Web Server best practices
• Apply a trusted certificate
• Optional: Additional HTTP Response Headers

Be aware that a high level of server hardening can lead to failure in your deployment. Be mindful of always having a backup to restore to in case your configuration leads to irreversible failure.

1. Authentication

Qlik Sense Enterprise on Windows supports multiple different Authentication Solutions;

• Windows (NTLM)
• Kerberos 
• Ticketing
• SAML
• JWT
• Header
• Anonymous

Qlik can not specify which authentication method is appropriate for each deployment. It is advisable to review currently supported alternatives within your organization and/or Identity Provider (IdP) to implement the most suitable solution for your use case.

2. Authorization 

Qlik Sense Enterprise on Windows provides two levels of native authorization in the product.

Security Rules

Attribute based access control (ABAC), which is configured through Qlik Sense security rules. This article will not go in depth on how to best implement security rules for your requirements, but it is highly recommended to think of your users based on the capabilities that you intend to provide them. For example different roles and capabilities as shown in image below, allows for a security rule framework to be designed and implemented. This can be done either by yourself by referencing Qlik Sense Help for Administrators and available assets or by engaging with a Qlik Consultant or Qlik Partner.

Section Access

Row level data reduction, which is configured through Section Access at Qlik Sense app level. This article will not go in depth on Section Access implementation, but with this reduction a single file can be used to hold the data for a number of users or user groups. Qlik Sense uses the information in the section access for authentication and authorization, and dynamically reduces the data, so that users only see their own data. 

3. Operating System Hardening

Qlik Sense Enterprise on Windows inherits the available protocols, cipher suites, key exchanges and other security hardening which are enabled on the Windows Server operating Qlik Sense.

Step 1: Disabling protocols and ciphers

Windows Server has a lot of protocols enabled by default; however protocols, ciphers, hashes and key exchanges that are considered deprecated or not secure enough should be disabled. There are many ways of doing this, and the Windows administrator and security experts should be consulted so that local policies are accurately applied. For simplicity, understanding and a good overview IIS Crypto 3.0 can be a good tool for evaluating current Windows configuration and applying changes. 
Keep in mind that "Best Practice" today might not be recommended in the near future, what was considered "safe" a while ago is not necessarily considered so today. For this reason, it is also important to regularly scan servers for potential vulnerabilities and revisit configurations as required. 

The Windows Server needs to be restarted for these settings changes to take effect. It is also important to ensure that all components running on the server still operate as expected after hardening is applied, for example, older non-Qlik software might not be compliant with the latest options and standards. 

Step 2: Firewalls

Firewalls typically should be closed, with required ports only opened for intended purposes.
See Qlik Sense Enterprise on Windows ports overview for details on required port based on the deployed architecture.

Step 3: Service Account Permission

For most organizations, local administrator rights allow for an easier deployment, but Qlik Sense Enterprise on Windows does not require local administrator rights in order to function. This can be an attractive option inside some organizations. This will require additional configuration of boot strap mode as described in Qlik Sense Enterprise on Windows Services.
For a brief overview of the rights needed by a Qlik Sense Enterprise service account:

• Full control over the share used by Qlik Sense Enterprise
• Full control over the installation directory (default: C:\Program Files\Qlik)
• Full control over %ProgramData%\Qlik
• Full control over any folders used as data connections

Qlik Sense Enterprise for Windows does not officially support Group Managed Service Accounts (gMSA), but it can operate using one. The initial barrier is that the installer requires a service account and password to be entered during installation. A domain or local account could be substituted for the install stages only to be swapped out in the Windows Services applet (services.msc) after installation. Some functionality may require workarounds (e.g. A User Directory Connection to Active Directory).

Step 4: Anti-Virus

Qlik Sense Enterprise on Windows does require exceptions from anti-virus scan to avoid potential disk I/O conflicts. Refer to Qlik Sense Folder And Files To Exclude From AntiVirus Scanning for more details. 

Step 5 (Optional): FIPS

Qlik Sense Enterprise on Windows can run with Federal Information Processing Standards (FIPS) enabled on the Windows Server. This does require a few adjustments of configuration files due to Qlik using non-FIPS compliant algorithms for minor tasks like hash checks. See Running Qlik Sense on Windows systems with FIPS compliance enabled for more details on Qlik Sense and FIPS.

4. PostgreSQL Hardening

Qlik Sense Enterprise on Windows uses PostgreSQL to store meta-data relating to a Qlik Sense site. In multi-node sites or sites where PostgreSQL is isolated from Qlik Sense Enterprise for Windows additional security can be applied;

• Database Traffic Encryption
• Hardening what endpoints are allowed to connect to PostgreSQL as described in PostgreSQL: postgresql.conf and pg_hba.conf explained

5. Generalized Web Server best practices

Qlik Sense Proxy service bundled with Qlik Sense Enterprise on Windows is simply a web-service. This means applying general practice guidance but in the context of Qlik Sense as described below.

Apply a trusted certificate

Qlik Sense Enterprise on Windows acts as a Certificate Authority (CA) during initial installation and signs a certificate that is applied on all encrypted traffic between Qlik Sense services. The same Qlik Sense signed certificate is applied as default certificate also for incoming connections from users accessing Qlik Sense Hub and QMC. This default certificate is not intended for production use, unless user access to Qlik Sense comes through a network load balancer or reverse proxy that trusts the Qlik Sense certificate. For direct user access to Qlik Sense Proxy, a fully trusted certificate can typically be acquired from your local IT and then applied on the Qlik Sense Proxy service. 

As of July 2019, Qlik Sense Enterprise on Windows support SHA1 and SHA2 certificates. If SHA384 or SHA512 certificates are needed, then a network load balancer or reverse proxy can be configured in front of Qlik Sense which offloads to Qlik Sense.

Optional: Additional HTTP Response Headers

There are numerous HTTP response headers that can be used in attempting to secure a server. Below are a couple of the most common ones, but as always it is recommended to consult local IT and web security expert on what the recommendations are. 

Any additional HTTP response header values can be configured in Qlik Sense Virtual Proxy settings under Additional response headers as shown in the below image and described in Qlik Sense for Administrators: Virtual Proxies. It is recommended to trial any header changes in a new virtual proxy, as poor configuration may accidentally lock you out from Qlik Sense access. 

• HTTP Strict Transport Security (HSTS) HTTP Strict Transport Security (HSTS) is an opt-in security enhancement which any web application can support through the use of a special response header. When a supported browser receives this header that browser will prevent any communication sent over HTTP in the future and will redirect all traffic over HTTPS instead. Caution is advised when implementing HSTS, as it might block HTTP access to certain pages that actually requires it or needs to be excluded from HSTS. See MDN Web Docs: Strict-Transport-Security for more details on configuration options. 
• Optional: X-Content-Type-Options X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing. 
• X-Frame-Options will prevent the site to be embedded in an iFrame, which can effective mitigate against ClickJacking attacks
• Content-Security-Policy: policy (old: X-XSS-Protection) improves security against some types of XSS (cross-site scripting) attacks.

  Policy is a placeholder for your policy of choice and cannot be used as a value. See Writing a Policy (Mozilla) for examples.