Tripwire App for QRadar Documentation

Transcription

1 Tripwire App for QRadar Documentation Release Tripwire, Inc. April 21, 2017

2 CONTENTS 1 Introduction 1 2 Tripwire Enterprise Features Prerequisites Setup Admin Configuration Options Dashboard Items Right-Click Context IP Search Running Tripwire Enterprise Checks From Events Querying FIM and SCM Data i

3 CHAPTER ONE INTRODUCTION The Tripwire App for QRadar provides enhanced integration capabilities for Tripwire products in the IBM Security Qradar SIEM solution. Today the Tripwire App for QRadar supports the following Tripwire products: Tripwire Enterprise 1

4 CHAPTER TWO TRIPWIRE ENTERPRISE Once properly configured, the Tripwire App for QRadar will periodically poll the Tripwire Enterprise console REST API for FIM and SCM data, and automatically send LEEF events into the QRadar system via Syslog. 2.1 Features The following features are included for Tripwire Enterprise: FIM/SCM event polling via the Tripwire Enterprise REST API. A set of DSM s for the Tripwire Enterprise FIM and Tripwire Enterprise SCM Events. A set of dashboard charts for FIM and SCM, with node and time range filters. Right-click context menu to search for IPs in the Tripwire Enterprise console. The capability to create offense rules based off of QRadar events to run checks in Tripwire Enterprise against IP addresses from those events. A rule for System Configuration events to kick off real-time checks in Tripwire Enterprise against Cisco IOS systems that are sending Syslog events into Qradar. 2.2 Prerequisites To use this extension, you must meet the following requirements. 1. A Tripwire Enterprise console on version or above. 2. QRadar should have a route to your Tripwire Enterprise console. 3. You must have at least 1.2 GB of memory available to this extension in your QRadar system. 2.3 Setup 1. Login to QRadar and navigate to the Admin tab. 2. In Extension Management, add and install the extension zip file. 2

5 Tripwire App for QRadar Documentation, Release Once installation is complete, refresh the page. 4. Create an Authentication Token for Tripwire (a) Open Admin -> Authorized Services (b) Click Add Authorized Service (c) Enter Tripwire for the Service Name. (d) Set the user Role to Admin and Security Profile to admin. (e) Check No Expiry (f) Click the Create Service button (g) Copy the Authentication Token for the Tripwire Service that you just created. (h) Make sure you click the Deploy Changes button on the Admin tab. 5. Open Admin -> Scroll to plugins -> Click Tripwire Enterprise. Configure the settings appropriately and click save. You can view the Admin Configuration Options page for an explanation of those settings. 6. Optionally you can create rules for QRadar events to automatically run checks against Tripwire Enterprise nodes in real-time. You can view the Running Tripwire Enterprise Checks From Events page for more information on that. 2.4 Admin Configuration Options This page describes in more detail the configuration options available on the Tripwire Enterprise configuration screen. 1. Tripwire Enterprise Console IP The IP address of the Tripwire Enterprise server. This is a required configuration option. 2. Username The login used to poll data from the Tripwire Enterprise console. You should establish a new user for QRadar within Tripwire Enterprise. This user should have limited read only access. This is a required configuration option. 3. FIM Poll Interval The interval at which FIM data from Tripwire Enteprise will be periodically polled. A good value here is every 1 hour. A value of 0 will prevent this data from being polled. 4. SCM Poll Interval The interval at which SCM data from Tripwire Enteprise will be periodically polled. A good value here is every 1 hour. A value of 0 will prevent this data from being polled. 5. SCM CSV list of policy names to pull data for A CSV list of SCM policy names that you want to poll data for. If nothing is set, data for all policies will be polled by default. 6. Historic Data Pull Days The number of days in the past to poll data for. This value is only used the first time we poll data. After the first data poll, we ll only poll for new data. 7. Password The Tripwire Enterprise password for the specified username. 8. Confirm Password Confirm the Tripwire Enterprise password Admin Configuration Options 3

6 Tripwire App for QRadar Documentation, Release Authentication Token An authorized service token for Tripwire. 2.5 Dashboard Items This extension comes with a variety of FIM and SCM dashboard items that will visually represent the FIM and SCM events that have been sent into QRadar via the FIM and SCM data pollers. Each dashboard item contains filters that allow specifying the range of time for the events that the dashboard shows as well as to filter on the node names represented in the data. To add a Tripwire Enterprise FIM or SCM dashboard item to one of your existing dashboards: 1. Navigate to Dashboard 2. Select the appropriate dashboard from the dashboard dropdown, or create a new one. 3. Click Add Item and hover Tripwire Enterprise FIM or Tripwire Enterprise SCM to view the list of items you can select. 2.6 Right-Click Context IP Search A right-click context menu item is provided by this extension that will appear when right-clicking an IP address in QRadar. This will open up a search for that IP address within the Tripwire Enterprise console. To use this search feature, right-click an IP address in QRadar and select Search Tripwire Enterprise. 2.7 Running Tripwire Enterprise Checks From Events This extension comes with an included rule that will automatically kick off checks in Tripwire Enterprise for Cisco IOS devices when their configurations are modified through the configure terminal shell. This will only work if the Cisco IOS device has been configured to send Syslog events to QRadar. You can also set up your own custom rules to run checks in Tripwire Enterprise against IP addresses that appear in any events in QRadar. Once your rule is configured, any IPs that get added to the Pending Tripwire Enterprise Node Checks reference set will be picked up by the extension. If a node in Tripwire Enterprise matches the IP that was added to the reference set, we ll kick off checks against that node automatically. This can allow for real-time checks of devices that Tripwire Enterprise must scan agentlessly, such as with network devices like Cisco IOS. 1. Go to Offenses -> Rules 2. Click Actions -> New Event Rule 3. Configure the rule to match any events you want. 4. Make sure you set the rule response to Add to a reference Set and pick Pending Tripwire Enterprise Node Checks - IP 2.5. Dashboard Items 4

7 Tripwire App for QRadar Documentation, Release Ensure the rule is enabled. 2.8 Querying FIM and SCM Data Once the FIM and SCM pollers begin sending LEEF events into the QRadar system over syslog, you will be able to query for those events using the following advanced search queries: SELECT * FROM events WHERE LogSourceTypeName(deviceType) = Tripwire Enterprise FIM LAST 30 DAYS; SELECT * FROM events WHERE LogSourceTypeName(deviceType) = Tripwire Enterprise SCM LAST 30 DAYS; 2.8. Querying FIM and SCM Data 5