IBM Developer

Article

Import IOCs from MISP to IBM Security QRadar

Share threat information and combat malicious actors

By Rahul K.P., Anuj Shrivastava

On this page

Organizations have to respond to threats quickly. Malicious actors often target multiple companies at the same time, making the sharing of threat information vital. The Malware Information Sharing Platform (MISP) is a threat-sharing platform that makes it easier to exchange information with trusted partners. Now, a new tool makes it easy for you to import that information into IBM Security QRadar.

Share threat information

The IOC Importer tool provides a web interface for you to easily import Indicators of Compromise (IOCs) from MISP to IBM Security QRadar, IBM's security and event management system. By sharing IOCs, you can respond quickly to security threats and lower the risk that your organization will be damaged by malicious actors.

At a high level, the user inputs server details, API keys, and polling intervals to enable automated data transfer. The IOC Importer displays recently imported IOCs and maintains operational logs for monitoring activities and troubleshooting issues.

IOC Importer

What does IOC Importer do?

You can't waste time when your systems are threatened. The IOC Importer saves you time and lets you focus on countering malicious activity. The main actions that the IOC Importer enables you to complete include:

  • Collecting user input: The application provides an interface for users to input data necessary for importing IOCs from MISP to QRadar, including the MISP and QRadar server details, the API keys for both systems, the reference set name for QRadar, a polling interval, an event ID, and an IOC type.

  • Initiating the import process: When the user has input all the necessary information and clicks the Import IOCs button, the application initiates the import process from MISP to QRadar.

  • Displaying the last 10 IOCs: The application displays the last 10 imported IOCs in a table format for user reference.

  • Displaying application logs: The application has a logging feature that displays logs regarding the application's operations in real-time. These logs help users keep track of what the application is doing and whether any errors are occurring.

  • Handling polling operations: The application handles automatic polling based on the user's inputted interval, fetching new IOCs from MISP and importing them to QRadar. This operation is performed regularly and is counted down in the application's interface.

IOC Importer last 10 IOCs

Potential improvements

QRadar clients have been requesting the IOC Importer tool for some time and we anticipate that they will make use of it immediately; however, there are definitely some improvements that we want to make in the future. Following are some potential improvements to the tool, although there is no update schedule and we need to stress that these are hoped for updates and not commitments.

  • Validation of user input: Currently, there is very little validation of user input. Implementing validation checks for correct formats and data types can prevent operation errors.

  • Error handling and display: While the tool does currently log error messages, users will find it easier if the errors are displayed more prominently by, for example, using pop-up alerts.

  • Secure storage of API keys: Right now, API keys are simply input and transmitted. We're looking to implement a more secure method of storing and transmitting these keys.

  • User authentication: The tool does not currently have any form of user authentication. An authentication system will improve security and enable a more personalized experience.

  • Expansion of supported IOC types: Currently, the tool supports a limited number of IOC types. By expanding this list to include other common IOC types, we can broaden the tool's usefulness.

How to install IOC Importer

It's quite easy to install the IOC Importer. To install the tool on QRadar using the SDK, complete the following steps:

  1. Go to the qradar-misp-ioc-importer GitHub repository to get the tool's .zip file.

  2. Optional: Identify your default server and user values by running the following command. Replace <QRadar_server> with the IP address or hostname of your QRadar console, and replace <QRadar_user> with the user name of a user with the necessary permissions to deploy applications.

    qapp server -q <QRadar_server> -u <QRadar_user>

  3. Package the application:

    qapp package -p com.mycompany.myapp.zip

  4. Deploy the application to QRadar. Replace <QRadar_server> with the IP address or hostname of your QRadar console, and replace <QRadar_user> with the user name of a user with the necessary permissions to deploy applications. The tool will be uploaded to QRadar and installed for use.

    qapp deploy -q <QRadar_server> -u <QRadar_user> -p com.mycompany.myapp.zip

  5. To run IOC Importer, use the following routes:

    • To run on QRadar:

      @viewsbp.route('/index', methods=['GET', 'POST']) # for QRadar

    • To run on Docker locally:

      @viewsbp.route('/', methods=['GET', 'POST']) # for Local system

Summary

The IOC Importer will help you respond to threats more quickly and efficiently. It enables you to import Indicators of Compromise from MISP to QRadar, taking advantage of the threat intelligence shared by trusted partners using MISP right in your QRadar implementation. The time and effort you save can be put towards fending off threats and malware.

To get more technical details about how the IOC Importer works, including functions, classes, and processes, see the application documentation.

To learn more about the IBM Security QRadar SDK, see the following resources: