XGS & QRadar Integration

Size: px

Start display at page:

Download "XGS & QRadar Integration"

Bartholomew Little
5 years ago
Views:

IBM Security Support Open Mic - January 28, 2015 XGS & QRadar Integration Advanced Threat Protection Integration Options Panelists Wes Davis Advanced Threat Support Group Engineer (Presenter) Thomas

1 IBM Security Support Open Mic - January 28, 2015 XGS & QRadar Integration Advanced Threat Protection Integration Options Panelists Wes Davis Advanced Threat Support Group Engineer (Presenter) Thomas Gray Senior Support Manager (Moderator) Rich Friedel Advanced Threat Support Group Engineer Jesse Widvey Advanced Threat Support Group Engineer Brian Wong QRadar Support Technical Lead Andrew Sallaway - SWAT Consultant Tanmay Shah - IPS L2 Product Lead Moazzam Khan IPS L3 Software Engineer Bob Budnek - AVP Engineer Ed Leisure IPS Knowledge Engineer Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA toll-free: Participant passcode: Slides and additional dial-in numbers: NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call.

2 Agenda QRadar overview QRadar/XGX/GX Integration Walkthrough XGS Advanced QRadar XGS/GX Troubleshooting Q&A 2

3 QRadar Overview

4 What is QRadar? IBM QRadar Security Intelligence Platform products provide a unified architecture for integrating security information and event management (SIEM), log management, anomaly detection, incident forensics and configuration and vulnerability management. These products offer advanced threat detection, greater ease of use and lower total cost of ownership. 4

5 QRadar/XGS Integration

6 QRadar and XGS Integration Overview Typical topology of an integrated deployment 6

7 QRadar/XGS rsyslog 7

8 LEEF vs Syslog Leef MMM DD hh:mm:ss yyyy-mm-ddthh:mm:ss+ Sensor_Name LEEF:1.0 IBM ISNP name cat=security devtimeformat devtime sev proto originator alpsd :adapter AdapterID AdapterMode algorithm-id appid block count iprdststate iprlicensed iprsrcstate ipsid nvpdata Syslog MMM DD hh:mm:ss yyyy-mm-ddthh:mm:ss+ Sensor_Name alpsd AdapterID AdapterMode algorithm-id appid block count dstip iprdststate iprlicensed iprsrcstate ipsid name nvpdata 8

9 Send XGS Security Events to QRadar 9

10 XGS Log Source configuration 10

11 QRadar Right-click Plugin /opt/isnp/isnp_alert.conf Right-click an event in the Log Activity Tab Select Plugin Options Send ISNP Alert Close the popup window 11

12 QRadar Right-click Plugin /opt/isnp/isnp_alert.conf Obfuscate your username/password combination: /opt/isnp/isnp_alert.pl -C /opt/isnp/isnp_alert.conf -T encrypt 12

13 QRadar Right-click continued 13

14 QRadar/GX Integration

15 GX QRadar Integration LEEF Security, Health, System, Connect Event, User-defined events /var/iss/leef.log 15

16 Adding QRadar as a syslog server 16

17 GX QRadar Event Details 17

18 Raw Payload and /store 18

19 Troubleshooting

20 Troubleshooting Tcpdump -s 0 -A host (ip of xgs/gx) and port 514 (syslog port) 20

21 Troubleshooting continued 21

22 22

23 Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in the IBM dw Answers forum on this topic: 28-january-2016-x/ 23

Where do you get more information? IBM QRadar Knowledge Center: http://www.ibm.

24 Where do you get more information? IBM QRadar Knowledge Center: Configuring an XGS log source for QRadar: g=em Configuring QRadar SIEM to forward advanced threat protection alerts to IBM Security Network Protection (XGS) appliances: IBM developerworks XGS and QRadar Intergration: Useful links: How to Contact IBM Software Support for IBM Security IBM Support Portal Sign up for My Notifications Follow us: 24

Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your

25 Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. THANK YOU Copyright IBM Corporation All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or capabilities referenced in these materials may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries or both. Other company, product, or service names may be trademarks or service marks of others.

IBM Threat Protection System: XGS - QRadar Integration

IBM Security Network Protection Support Open Mic - Wednesday, 25 May 2016 IBM Threat Protection System: XGS - QRadar Integration Panelists Tanmay Shah - Presenter Level 2 Support Product Lead Danitza Villaran-Rokovich,