IBM Security Support Open Mic

Transcription

1 IBM Security Support Open Mic LET S TALK ABOUT QRADAR FEATURES Connect to WebEx Audio by selecting an option in the Audio Connection dialog or by accessing the Communicate > Audio Connection menu option. For more information, visit: Wednesday, 12 October 2016, 11:00 AM EDT The webcast will start approximately 2 minutes after the hour NOTICE: BY PARTICIPATING IN THIS CALL, YOU GIVE YOUR IRREVOCABLE CONSENT TO IBM TO RECORD ANY STATEMENTS THAT YOU MAY MAKE DURING THE CALL, AS WELL AS TO IBM S USE OF SUCH RECORDING IN ANY AND ALL MEDIA, INCLUDING FOR VIDEO POSTINGS ON YOUTUBE. IF YOU OBJECT, PLEASE DO NOT CONNECT TO THIS CALL.

2 Panelists Jeremy Mathers Team Lead QRadar User Interface Alex Reddon L3 Software Engineering Joey Maher Security Operations Leader for QRadar Support Adam Frank Principle Solutions Architect for QRadar Support Greg Davis QRadar Architect Ellen Pitt Senior Manager Quality Assurance Presenter: Jonathan Pechta Support Technical Writer / Support Content Lead Assisting: Michael Hunt Support Knowledge Co-op student 2 IBM Security

3 QRadar Feature Discussion Agenda Upgrade Instructions New features and changes in QRadar API Updates DSM Editor User Deletion Offense Improvements Naming Assigning Search Enhancements Search Speed and Functionality AQL Domain Aware Reference Sets Tenant Data Segregation Resource Restrictions X-Force IP Reputation Data is now free to all QRadar administrators 3 IBM Security

4 Announcements

5 QRadar YUM vs RPM As of the most recent QRadar automatic update, development has added more support for YUM commands. Administrators and users will notice that our documentation examples will start using YUM commands, which are now preferred over using RPM commands to prevent patch and dependency issues. yum install DSM-BluecoatProxySG noarch.rpm yum y install DSM-BluecoatProxySG noarch.rpm This replaces rpm Uvh commands yum search WinCollect This replaces rpm qa grep WinCollect New M4 Firmware Available A new firmware was recently released for M4 appliances that supersedes firmware v1.1, which is This new firmware is available on IBM Fix Central, with a new master firmware version page for administrators at: 5 IBM Security

6 New shortened URLs available for users to find information quickly New shortened links available to users: - links to the dw Answers forum with the qradar tag. - links to the master firmware version list. - links to the master software version list. - links to the support page for opening PMRs. - links to all support technical notes. - links to the Request for Enhancement system sorted to QRadar. - links to a list of all QRadar Open Mic slide decks. - links to the QRadar X-Force FAQ page. - links to content on how to collect logs for different issues. - links to the official QRadar Support Lifecycle page. - links to the release notes for QRadar Important: On January 11, 2017 QRadar 7.1 Software is going End of Support (EoS). End of Support (EOS) indicates the date at which no further software defect corrections or Security Updates will be made available. We have updated our QRadar Lifecycle Information pages for QRadar to detail how this change impacts users and administrators. This information was discussed in the Sept 2016 QRadar Support Newsletter. 6 IBM Security

7 Upgrading

8 Upgrade - Instructions Software Upgrades Release notes: QRadar (any patch level or above) is the minimum version to upgrade to QRadar This article outlines the software upgrade progression to get from QRadar version x --> y. If a customer calls with upgrade questions or cannot find the proper software to upgrade, you can direct them to this article. Patch & Upgrade Best Practices Run a configuration backup & download the file before upgrade Ensure all HA pairs have the PRIMARY system active, and the secondary is online place patch files in /store/patches/ stage the patch/upgrade file out to all managed hosts, if required Patch console first, then all managed hosts simultaneously, not using "patch all Upgrades versus ISOs Admins use SFS files to patch/upgrade a system to QRadar New installations use ISO files. HA Considerations Note, patches should not ever be run on the HA secondary, if it's the active host - you should fail back to the primary. IF the primary is offline/failed for some period of time, the upgrade for the entire deployment should be delayed. 8 IBM Security

9 QRadar Post upgrade password changes Password storage upgrades are being enforced: Passwords that were created pre will need to changed. This is due to cryptographic processing updates for increased password security. Users created at or after QRadar or who have changed their password since will not need to re-encrypt their password after upgrading to Admin users who use external authentication have a local QRadar password in case the authentication server is unavailable, these passwords may have to be changed. Users that require a password update are provided this screen: 9 IBM Security

10 API Updates

11 API Updates introduces V7.0 endpoints The following APIs have been deprecated which may be removed in a future release: 5.0 & 5.1 QRadar introduces several new or updated endpoints the following categories: Analytics API endpoints Ariel API endpoints Asset model API endpoints Configuration API endpoints Data classification endpoints Forensics API endpoints IBM QRadar Risk Manager IBM QRadar Vulnerability Manager Reference data API SEIM API endpoints Staged configuration API endpoints System API endpoints 11 IBM Security

12 API Resources QRadar API doc link: To discuss, share, and troubleshoot APIs use our customer forum: API Samples and Examples on GitHub: 12 IBM Security

13 DSM Editor

14 Using the DSM Editor introduces a DSM Editor to assist administrators with data ingestion and replaces writing XML by hand to construct Log Source Extensions. Accessed by selecting desired events and then Actions -> DSM Editor Allows for: Field Extraction, Custom Property Definition, Event Categorization, and New QID Definition Log Activity > Actions > DSM Editor 14 IBM Security

15 DSM Editor Select Log Source Type 15 IBM Security

16 DSM Editor - Use 16 IBM Security

17 DSM Editor - Use Workspace this area displays the event information. When administrators select one or more events from the Log Activity screen, then select DSM Editor, the payloads from those selected events are displayed in the Workspace view. Using the Pencil icon, administrators can edit the payload in the workspace and save the changes using the check mark button. 17 IBM Security

18 DSM Editor - Log Activity Preview Simulates what data would be populated in the Log Activity window for the log source. 18 IBM Security

19 DSM Editor Available Event Properties Properties 19 IBM Security

20 DSM Editor - Property Editor 20 IBM Security

21 DSM Editor - Event Mappings 21 IBM Security

22 User Deletion Framework

23 User Deletion - Use Deletion framework has been expanded to include users 23 IBM Security

24 User Deletion Locating Dependent Data Deletion framework has been expanded to include users and locates data owned by users so information can be reassigned or deleted if required. 24 IBM Security

25 User Deletion Viewing Dependent Data Deletion framework has been expanded to include users 25 IBM Security

26 User Deletion Reassigning data A user must exist in QRadar to inherit and take ownership of data from another user. 26 IBM Security

27 User Deletion - Use Deletion framework has been expanded to include users 27 IBM Security

28 User Deletion Deleting Data 28 IBM Security

29 User Deletion Deleting the User After the user does not have any dependencies, the user can be deleted. 29 IBM Security

30 Offense Renaming

31 Offense Renaming - Use When dispatching new events from rules, users can choose to index the offense created by those events by custom properties. This allows for offenses to be created with useful names 31 IBM Security

32 Offense Assigning New interface available The QRadar offense assigning dialog has been updated with a Type to filter user interface. Multi-tenants: All eligible users with tenant/company Single-tenants: All eligible users with their description 32 IBM Security

33 Search Performance

34 Search Enhancements and Performance Upates now supports 1M assets out of the box. Available up to 3M with tuning options (constraining the number of vulnerabilities). Supported asset limit no longer relies on HA. Asset tab query performance has been increased by 35X. This update decreases wait times in the from minutes to less than 10 seconds. Vulnerabilities interface query performance has been increased by 2X 34 IBM Security

35 AQL Updates

36 Search Enhancements AQL - Use now supports nested queries in AQL using IN or FROM queries For example: select sourceip as Risky Hosts from events where destinationip in ( select sourceip from events where eventdirection = L2R and REFERENCESETCONTAINS('CriticalWatchList', destinationip) group by sourceip ) group by sourceip last 24 hours SELECT username FROM (SELECT * FROM events WHERE username IS NOT NULL LAST 60 MINUTES) SELECT * FROM EVENTS WHERE sourceip IN (SELECT destinationip FROM events) 36 IBM Security

37 Reference Set Improvements

38 Domain Aware Reference Set - use Reference Sets are now domain aware In phase I, tenant users can only view their reference data values through UI or rest api and they can t create a new reference containers like a set, map or etc. To create a new container, they should send a request to your service provider. A Domain column is now added to the Reference Set interface. Updating domain info in Reference Data REST API Content Management Tool (Command line and UI) ReferenceDataUtil.sh Rule Response 38 IBM Security

39 Domain Aware Reference Set - use When adding Reference Set data, you can choose the domain 39 IBM Security

40 Domain Aware Reference Set - use Reference Set UI Filtering has been improved 40 IBM Security

41 Domain Aware Reference Set - use Reference Set Data UI Import is now domain aware and allows administrators to import CSV files against a specific domain. 41 IBM Security

42 Domain Aware Reference Set - use Shared Data Similar to the concept of any domain. The reference value would be seen by everyone. Specific Data Reference value would be tagged by the domain given in the event or flow payload 42 IBM Security

43 Data Retention Improvements

44 Tenant Data Segregation Retention Buckets now respect tenants Each tenant gets 10 retention buckets for events 10 retention buckets for flows 44 IBM Security

45 Resource Restrictions

46 Resource Restrictions can now be defined MSSP Admin can now restrict tenants' Ariel queries based on: Execution Time : Events/Flows query would be automatically stopped after the assigned period of time Time Span : Events/Flows query is limited to the assigned time range Record Limit : Events/Flows query will be automatically stopped after it reaches the assigned number of records Precedence Order User Role Tenant 46 IBM Security

47 Resource Restriction - Use Resource Restrictions have been introduced in Admin tab > Resource Restrictions 47 IBM Security

48 Resource Restriction User list Resource Restrictions have been introduced in IBM Security

49 Resource Restriction - Configuration Resource Restrictions have been introduced in IBM Security

50 Resource Restriction in Search Parameters Resource Restrictions have been introduced in Login with a restricted user. Restriction appears on log and network activity tabs 50 IBM Security

51 X-Force Enhancements

52 X-Force IP Reputation Data Licenses are now free Administrators running will no longer have to pay for the use of the X- Force premium feed of data into QRadar. Users who do not upgrade will remain on the subscription model until the time that they upgrade to To enable X-Force Threat Data on deployments that have not had it licensed in the past can use a new System Setting value. Reminder: X-Force IP and URL rules are not installed by default if you are a new user. To download the Threat Extension that contains X-Force Rules, see: 52 IBM Security

53 X-Force is now Free! - Any "QRadar X-Force IP Reputation Intelligence Feed" key is no longer displayed in the "Licenses" Display of "System and License Management" page. - These should not appear for every console and managed host: 16XX, 17XX, 18XX, 2000, 21XX, 31XX (includes SaaS console), 6100, 8XXX appliances. 53 IBM Security

54 X-Force Rule Wizard - X-Force tests are also always displayed even if 'X-Force Feed' system settings is disabled. 54 IBM Security

55 X-Force Testing that you are getting feed data A quick method to test if you are receiving X-Force data is to run a generic X-Force query using the Advanced Search bar in QRadar. SELECT sourceip, XFORCE_IP_CATEGORY(sourceip) FROM events WHERE XFORCE_IP_CATEGORY(sourceip) IS NOT NULL LAST 10 MINUTES Note: If you did not update your System Settings to enable X-Force Threat Feeds, you will get the following error: 55 IBM Security

56 Getting more involved

57 User interface survey 10 questions (Anonymous) The QRadar user interface team is interested in hearing your opinion on our user interface and new features as we roll them out. This 10 question survey allows administrators to provide feedback and also includes a address for those interested in seeing future QRadar builds and providing feedback on the interfaces that we build. The goal is to bring the user / administrator close to the day-to-day work of the QRadar developer and provide feedback and usability information for future QRadar improvements. QRadar User Interface & Feature Survey: 57 IBM Security

58 THANK YOU FOLLOW US ON: QRadar Forums: securityintelligence.com xforce.ibmcloud.com Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. Any statement of direction represents IBM's current intent, is subject to change or withdrawal, and represent only goals and objectives. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party.