ThreatScape App for QRadar: Overview, Installation and Configuration

Size: px

Start display at page:

Download "ThreatScape App for QRadar: Overview, Installation and Configuration"

Alexandrina Parsons
5 years ago
Views:

1 ThreatScape App for QRadar: Overview, Installation and Configuration December 16, 2015

2 App Description... 3 System Requirements... 3 ThreatScape App for QRadar Installation and Configuration... 3 Configuration... 3 Define isight Authorized Service... 4 ThreatScape App Admin Settings... 5 Configuration File... 7 ThreatScape App for QRadar Functionality... 7 isight Indicator Data in Reference Sets... 7 Recommended Rules... 8 IP Specific Rules... 9 URL Specific Rules... 9 Domain Specific Rules Logging and Troubleshooting ThreatScape App Specific Log ThreatScape App Specific Logs Troubleshooting Q&A All rights reserved. isight Partners, Inc. 2

3 App Description IBM QRadar is a market leader as per Gartner s 2015 Magic Quadrant for SIEM. QRadar consolidates log source event data from thousands of device endpoints and applications distributed throughout a network. The ThreatScape App for QRadar facilitates the delivery of isight Partners ThreatScape Indicators to our customers' QRadar instances. Once consumed by a QRadar instance, the ThreatScape Indicators are treated as QRadar reference sets and can be used in search, correlation, reporting, and visualization workflows in the same manner as other data. System Requirements The ThreatScape App for QRadar requires QRadar version or higher, and 35.6KB of disk space. ThreatScape App for QRadar Installation and Configuration The ThreatScape App for QRadar is available from IBM s Security App Exchange: 03.ibm.com/software/products/en/qradar- siem Configuration Once the ThreatScape App is installed, the isight ThreatScape application should be visible in the Admin tab of the QRadar application, under Plug- Ins All rights reserved. isight Partners, Inc. 3

4 Define isight Authorized Service The ThreatScape App requires various background jobs to retrieve isight indicator data. For background jobs to retrieve data automatically, we need to create the QRadar Authorized Service Security Token. Use the following procedure to generate the QRadar Security Token: 1. Click the Admin tab. 2. On the navigation menu, click System Configuration. 3. Click Authorized Services. 4. Click Add Authorized Service. 5. In the Service Name field, type a name for this authorized service. The name can be up to 255 characters in length All rights reserved. isight Partners, Inc. 4

5 6. From the User Role list, select Admin. 7. In the Expiry Date list, select the No Expiry check box. 8. Click Create Service. The confirmation message contains a authentication token field that you must copy into the isight ThreatScape App configuration, in the QRadar Security Token section to authenticate with the QRadar application. ThreatScape App Admin Settings Users are able to enter their API key information through API2 Server Configuration. Configuration of indicators ingested is accomplished by selecting Indicators of Compromise or Indicators of Warning sets of isight indicators, and selecting the IP, Domain, MD5, SHA1, SHA256, URL and Filename indicators from Indicator Selection. From Data Lifespan Settings, Time To Live (TTL) for indicators can be configured. TTLs are grouped into two groups: Short TTL and Long TTL for IP and Domain indicators. Other Indicators will never expire. Users should be able to modify the recommended TTL based on their own use case or internal weighting. Imported indicators should have a configurable TTL, with preset values that match the following: o 60 Days for an IP address and Domain from last seen (drone) o 90 Days for an IP address and Domain from last seen (controller) o For MD5, SHA1, SHA256, URL and Filename indicator timeout will be forever All rights reserved. isight Partners, Inc. 5

The user should be able to configure the internal organization s web proxy server from Network Proxy Settings by providing respective proxy details.

6 The user should be able to configure the internal organization s web proxy server from Network Proxy Settings by providing respective proxy details. To activate the web proxy settings, the user should click on the check box. Polling Rate is the interval in seconds at which the QRadar application will poll the ThreatScape API for new indicators. Incremental load can be triggered manually by clicking the Refresh Data Now button. From Initial Data Load, a historical indicator load can be triggered manually by entering days in Days to Load and clicking on Start Load. Note: In version 1 of the ThreatScape App, the initial load is limited to 90 days. isight Partners will evaluate expanding that limitation in future iterations. Property APIv2 Server URL APIv2 Server Public Key APIv2 Server Private Key APIv2 Endpoint Polling Rate Short TTL Long TTL Indicator Selection Days to Load Description isight Threatscape endpoint URL. By default it will be Threatscape API v2 public key Threatscape API v2 private key There are two endpoints supported view/iocs views/indicators Polling interval for incremental data load. Suggested 3600 sec Time to live for indicators tagged as short TTL IP, Domain Time to live for indicators tagged as long TTL Indicators to be polled Interval for full load. Load historical indicator data 2015 All rights reserved. isight Partners, Inc. 6

7 Start Load Refresh Data Now Save setting Proxy Host Proxy Port Proxy User Proxy Password QRadar Security Token Load full load Load incremental data since last successful run Save configuration Web Proxy IP/Hostname Web Proxy Port Web Proxy Username Web Proxy Password QRadar Security Token available from Qradar Authorized Services Field Definitions for Admin Settings Configuration File All of the configured values are saved into the application s app_config.ini file. This file can be used to cross validate the configuration made from the User Interface. Key and Password values are stored encrypted. ThreatScape App for QRadar Functionality The functionality of the ThreatScape App for QRadar is underpinned by ThreatScape API 2; the ThreatScape API is the repository from which the ThreatScape App for QRadar retrieves its data, after which QRadar users rely on the QRadar engine to leverage the ThreatScape API Data. The ThreatScape App for QRadar automates ingestion of indicators and leverages QRadar s new GUI Application framework to facilitate provisioning, correlation of isight indicators and easy access to intelligence context directly from the QRadar interface. isight Indicator Data in Reference Sets Reference sets are the data store, which contain a set of elements within the QRadar environment. isight indicators are stored in reference sets. Following are the reference sets created by the ThreatScape App for Qradar All rights reserved. isight Partners, Inc. 7

8 You can create rules to detect log activity or network activity that is associated with the above reference set. For example, you can create a rule to detect when an unauthorized IP attempts to access your network resources. Recommended Rules Rules perform tests on events, flows, or offenses, and if all the conditions of a test are met, the rule generates a response. If your events and flows fields do not get parsed properly, you may need to regex the IP, Domain, URL, and / or hash values from your logs as a custom field. More info: It is recommended that users create a group for isight Partners rules. This can be accomplished using the standard procedure for creating rule groups in QRadar All rights reserved. isight Partners, Inc. 8

IP, Source IP are contained in any of isight Partners IP Short TTL - IP, isight

9 IP Specific Rules Rule detail: Apply isight Partners: Intel- informed ip value detected on events or flows which are detected by the Global system and when any of Destination IP, Source IP are contained in any of isight Partners IP Short TTL - IP, isight Partners IP Long TTL - IP URL Specific Rules 2015 All rights reserved. isight Partners, Inc. 9

Rule detail: Apply isight Partners: Intel- informed url value detected on events which are detected by the Local system and when any of URL (custom) are contained in any of isight Partners URL -

10 Rule detail: Apply isight Partners: Intel- informed url value detected on events which are detected by the Local system and when any of URL (custom) are contained in any of isight Partners URL - AlphaNumeric (Ignore Case) Domain Specific Rules Rule Detail: Apply isight Partners: Intel- informed domain value detected on events which are detected by the Global system and when any of Domain are contained in any of isight Partners DOMAIN Long TTL - AlphaNumeric (Ignore Case), isight Partners DOMAIN Short TTL - AlphaNumeric (Ignore Case) Logging and Troubleshooting ThreatScape App Specific Log All ThreatScape App logs can be found at: /store/docker/vfs/dir/{dockerid}/log/app.log Application log files can also be accessed through the QRadar API endpoint: 2015 All rights reserved. isight Partners, Inc. 10

11 There are three levels of supported logging, configurable via the QRadar configuration: Log Level Filename Description INFO The standard info log, used to track regular operation of the info.log (Default) system. The error log is used to track any exceptions that occur during software execution, including but not limited to, ERROR error.log unexpected API calls and internal errors. Stack traces will be present where possible as well as pertinent state information. DEBUG debug.log Debug logging of the system, not enabled by default. ThreatScape App Specific Logs QRadar writes to a startup.log file to log high level actions initiated for the application, such as REST calls and message for application specific installation: /store/docker/vfs/dir/{dockerid}/log/startup.log Example: Dec 04 08:16: : pip install /src_deps/pip/ijson py2.py3- none- any.whl 172.x.x [04/Dec/ :17:45] "GET /admin HTTP/1.1" x.x [04/Dec/ :18:28] "POST /admin/save HTTP/1.1" x.x [04/Dec/ :18:45] "POST /admin/fullload HTTP/1.1" x.x [04/Dec/ :18:45] "POST /admin/checkloadstatus HTTP/1.1" 200 The app.log file contains most of the error statements that are related to the ThreatScape App for QRadar: /store/docker/vfs/dir/{dockerid}/log/app.log This file gets rolled over from app.log.1 through app.log.5. Troubleshooting Q&A Q) How does indicator data get fetched from the API Server? A) Fetching of indicator data is done in three different ways. After setting all required configuration values, User can click on Start Load at this point the app will fetch the data for number of days configured in the Days to Load section. After Start Load completes, the application will start to fetch the indicator data from API Server at the configured polling interval All rights reserved. isight Partners, Inc. 11

12 If user wants to fetch the data before the polling interval then they can click on the Refresh Now button. The app will fetch the data from last data fetch time to the current time. The ThreatScape App always saves the last successful data fetch time stamp in the applications configuration file. i.e. app_config.log Q) Reference Sets are not getting created? A) Check the application configuration for QRadar security token, ISIGHT API keys, API URL, polling interval and web proxy settings, if a web proxy is enabled. The respective error statement along with the status code is logged into the app.log file. Q) Refresh now functionality is not working? A) Check if other data pull operation is in progress or not. Check for latest Server: get_load_status busy : [True] message in the app.log. Value True reports data pull is in- progress. Q) How to identify the last successful indicator polling? A) The application logs the last successful indictor data fetch value into the app_config.ini. This file holds the last successful polling timestamp e.g last_run = The value is in epoch time format. Q) How to check which indicators are subscribed? A) The information for indicator subscription is available at application configuration UI itself. Same information is also available in the app_config.ini under [indicator_config] block. e.g. [indicator_config] domain = checked sha1 = checked url = checked ip = checked filename = checked sha256 = checked md5 = False Q) How to identify the last indicator data poll duration? A) Application fetches the indicator data from API Server for specific period of time. These details are available in the app.log. Locate isightapiclient.pullfeed(): fetchfrom: [epoch_time] query_execution_time: [epoch_time] message. The difference between fetchfrom value and query_execution_time is the data poll duration. Q) Elements in the reference sets are not get updated on indicator data fetch. A) There are below mentioned cases where data will not get updated in reference sets. There is a duplicate data received or data is already in the reference set. There is no new indicator data available from API Server. Verify the validity of configured QRadar token All rights reserved. isight Partners, Inc. 12

13 Verify the API keys are valid. Q) There are no offence notes in the notes sections of Offence. A) There are below mentioned cases for this issue The Offence notes get updated at 15 mins of interval. There is no information available at API server for the offence. Verify the validity of configured QRadar token. Verify the API keys are valid All rights reserved. isight Partners, Inc. 13

Tripwire App for QRadar Documentation

Tripwire App for QRadar Documentation Release 1.0.0 Tripwire, Inc. April 21, 2017 CONTENTS 1 Introduction 1 2 Tripwire Enterprise 2 2.1 Features............................................. 2 2.2 Prerequisites..........................................