IBM CLOUD APP ANALYTICS FOR QRADAR

Size: px

Start display at page:

Download "IBM CLOUD APP ANALYTICS FOR QRADAR"

Esther Singleton
5 years ago
Views:

1 IBM CLOUD APP ANALYTICS FOR QRADAR Getting Started Updated: March 6, 2017 Copyright IBM Corp. 2017

2 Introduction This document provides instructions for installing, configuring, and using IBM Cloud App Analytics for QRadar. This QRadar extension helps detect web application usage patterns within an organization and tracks the following information: The applications that are used on your networks XForce Threat Intelligence risk score Application access statistics for each user Prerequisites IBM Cloud App Analytics for QRadar requires a functional and licensed installation of QRadar SIEM version with Patch 1. The app also requires one or more of the following devices: Cisco IronPort McAfee Web Gateway IBM Security Network Protection Websense V Series Check Point FireWall Palo Alto PA Series Bluecoat SG Appliance Configure a log source so that the app has statistics to display. Here is an example of log source configuration settings: 1 Copyright IBM Corp. 2017

3 If you are using QRadar version 7.2.6, click on each of the following custom event properties and then click Save: UrlHost SentBytes ReceivedBytes This is due to a known issue with version specifically. 2 Copyright IBM Corp. 2017

4 Installing the application Use the following instructions to install the application: 1. Download the IBM Cloud App Analytics for QRadar application from the IBM Security App Exchange Portal at 2. Log in to the IBM QRadar console as an administrator. 3. Go to the Admin tab and click Extensions Management in the System Configuration section. 4. Click Add and select the application file that you downloaded. 5. Click Add. 6. Log out and log in again so that you can see the App Analytics tab information. Configuring the application Use the following instructions to configure the app for your environment: 3 Copyright IBM Corp. 2017

1. Click the Admin tab and go to User Management Authorized Services. 2. In the Manage Authorized Services tab, click Add Authorized Service. 3. Click Add Authorized Service. 4.

5 1. Click the Admin tab and go to User Management Authorized Services. 2. In the Manage Authorized Services tab, click Add Authorized Service. 3. Click Add Authorized Service. 4. Add the relevant information in the following fields and click Create Service: a. In the Service Name field, type a name for this authorized service. The name can be up to 255 characters in length. b. From the User Role list, select the Admin user role. c. From the Security Profile list, select the security profile that you want to assign to this authorized service. The security profile determines the networks and log sources that this service can access on the QRadar user interface. d. In the Expiry Date list, type or select a date that you want this service to expire. If an expiry date is not necessary, select No Expiry. 5. Click the row that contains the service that you created, select and copy the token string from the Selected Token field in the menu bar, and close the Manage Authorized Services window. 6. In the App Analytics app window, paste the authorized service token string into the Authorization Token field. 7. Click Start. Using the application You can view different aspects of your application data using the dashboard. Narrow down the list of users or apps by using the search field. Adjust the time interval to be daily, weekly, or monthly by using the drop-down menu. Dashboard 4 Copyright IBM Corp. 2017

The App Analytics view displays when you open the interface and provides the following application and user data: Applications discovered Applications not approved Applications that are high-risk

6 The App Analytics view displays when you open the interface and provides the following application and user data: Applications discovered Applications not approved Applications that are high-risk Users Users that are high-risk Rogue activity Incoming traffic Click the number under Applications Discovered to display the Applications list. Click the number under Users to display the details for the users. Applications view After you click the number under Applications Discovered on the dashboard, the Applications view displays. 5 Copyright IBM Corp. 2017

7 Approve an application from this view by selecting the check box in the Approved column. Click a row to get the details of the application. Filter the list by using the search field. Application details The application details view shows the statistics and the list of users. 6 Copyright IBM Corp. 2017

8 Click the Yes or No link under Approved to toggle the approval of the application. Click the XForce link to get more XForce details of the application. You can click each row in the table to show the details for a user. Users view After you click the number under Users on the dashboard, the Users view displays. 7 Copyright IBM Corp. 2017

9 This section shows the list of all users in the system. You can click each row in the table to show the details for a user. User details The user details view shows statistics for the user and a list of applications they have interacted with. You can search the list and you can click each entry to get more details on the application. 8 Copyright IBM Corp. 2017

10 Troubleshooting and known issues Problem: The dashboard displays Loading: or Loading: 100% complete but no data displays. Solution: Ensure that you configure a log source as described in the Prerequisites section above. If you are using QRadar version 7.2.6, you might encounter this problem. If so, perform the following steps to resolve the issue: 1. Go to Admin > Custom Event Property. 2. Search for "SentBytes", "ReceivedBytes", and UrlHost. 3. For each of these custom properties, open the property definition and click on the Save button. 9 Copyright IBM Corp. 2017

11 10 Copyright IBM Corp. 2017

IBM CLOUD DISCOVERY APP FOR QRADAR

IBM CLOUD DISCOVERY APP FOR QRADAR Getting Started Updated: January 31 st, 2018 Page 1 Introduction This document provides instructions for installing, configuring, and using IBM Cloud Discovery App for