Z AUDIT FOR QRADAR. Getting Started. Version Last Modified March 23, 2018

Transcription

1 Z AUDIT FOR QRADAR Getting Started Version Last Modified March 23, 2018

2 1 1. Overview This document describes how to install, configure and use the IBM Z Audit for QRadar (Z Audit) application. Z Audit provides insight for important security related events originating from IBM Z. By tracking and analyzing critical system events that interact with sensitive data, Z Audit helps ensure that your enterprise is securely configured to help minimize threats and prevent potential security breaches. Custom tailored dashboards help identify and collect detailed information necessary for ensuring compliance with various security regulations and audit mandates. Z Audit currently supports the following event types: Network: o zert TCP SMF record type Storage: o Dataset - SMF record types 14, 15 and Prerequisites Z Audit requires the following to be setup/configured: IBM Z Event Sources: zsecure (Event source collection agent) zert (Network TCP events) Data set SMF Records (Storage data set events) QRadar: IBM z/os Custom Properties - IBM z/os DSM 3. Installation Follow these steps to install the application: 1. Download the Z Audit for QRadar application from the IBM Security App Exchange portal at 2. Log in to the IBM QRadar console as an administrator.

3 2 3. Go to the Admin tab and click Extensions Management in the System Configuration section. 4. Click Add and select the application file that you downloaded. 5. Select Install immediately. 6. Click Add. 4. Configuration Z Audit does not require any external configuration settings to be set through the QRadar admin console. For configuring the Z Audit application dashboards see Configuring the Dashboards found under Using the Application. 5. Using the Application Z Audit provides a custom dashboard for each of the supported event categories. The dashboards help identify potential at risk events and collect useful related information. By default, the Network zert TCP dashboard is displayed when first loading the application. Screen 1: The Network zert TCP Dashboard The navigation panel, located on the left of the screen provides access to the other dashboards and components of the app.

4 3 5.1 Configuring the Dashboards Configuration settings, filters and additional information for each dashboard can be accessed by selecting the associated button found at the top right-hand navigation bar Settings This action button displays a settings modal which can be used to configure and set properties of the active dashboard. Screen 2: Settings Modal for Network zert TCP Dashboard Event Rules Event rules allow the user to define security constraints for specific events processed by the dashboard. These rules help Z Audit identify and categorize potential at-risk events to ensure the monitored systems are configured and secured properly.

5 Adding Rules New rules can be added by selecting the button which displays a new area containing several input fields used to specify the rule values. Screen 3: Event Rules Adding a new rule Defining a rule requires the following information: Rule Name: Unique name to identify and describe the rule. Event Source: Set of event source attributes to which the following security constraints should apply to. This input consists of a dropdown menu to specify the event source type and a text field to enter the associated value. * Event Security: Set of security constraints that should be applied to the event sources defined above. This input consists of a dropdown menu to specify the event security type and a text field to enter the associated value. * *Note: Multiple constraints can be specified by entering the required information and selecting the button.

6 5 Once all the necessary information is specified select the button to save the new rule to the table or select the button to clear all input fields and start again. Example Defining a rule for the Network - zert TCP dashboard that requires all events originating from System: MVSYS1 and User: USER1 to be secured with Protocol Version: TLSv1.2. Screen 4: Entering required information for new rule After the saving the rule the table will be updated to reflect the new entry: Screen 5: Updated table after saving new rule General Settings

7 6 These settings are used to configure general properties of the active dashboard. The following is a list of currently supported settings: Results Limit Used to limit the maximum number of results processed by the dashboard. This setting is useful to help improve performance and help prevent out of memory exceptions that may occur when dealing with a large number of events. Default: 20,000 Note: Since the app is still in early development it is recommended that the results limit not exceed 100,000 to prevent potential failures. If the app is crashing after setting a new result limit, the apps stored settings can be reset by clearing the browser cache entry for the app Filters This action button displays a filters modal which can be used to filter events processed by the dashboard. Values that can be filtered include: Time: Filter results based on a certain time frame. The time filter can be specified as a recent time span or date range. Event Attributes: Attributes associated with the event, for example, the state of a connection (short/long lived, open/closed). Event Fields: Fields or properties associated with the event, for example, username, source IP and protocol version. 5.2 Using the Dashboards Each of the Z Audit dashboards consist of several sections that contain various graphs and tables to help quickly identify and collect useful event related information. The following outline describes each of the sections in more detail Overview Overview of the dashboards status and configuration such as filters, settings and when it was last updated. The overview panel is collapsed by default.

8 7 Screen 6: Overview section expanded Graphs Several graphs help provide a quick visual overview of the dashboard status and key event statistics. Screen 7: Event Security Status and Events Over Time graphs The graph on the left displays an overview of important event related information such as the overall security status and certain event source/security properties. The graph type can by toggled by selecting the button. The graph on the right graph displays a time series plot for events over the specified time range. This graph is useful for identifying potential abnormalities in workload behavior or identifying at what times most at-risk events occur. The buttons can be used to select between various display options and event data for each of the graphs.

9 Stats Group of tables that display statistics for certain event related data. Tabs located at the top of this section can be used to select between the event data based on its security status. This section is collapsed by default. Screen 8: Expanded Stats Section Events Table that displays the individual events which can be selected to bring up a more detailed view. Tabs located at the top of this section can be used to select between the events based on their security status. Screen 9: Events List Section

10 9 The event details display the events security status in the top right corner and highlight any fields that satisfy or violate the applied rule constraints. Screen 10: Event Details of a secure event