Streamline QRadar multitenancy configuration with watsonx Assistant

In today's fast-paced and complex cybersecurity landscape, it’s crucial for organizations to efficiently manage security data across multiple tenants or business units. For Managed Security Service Providers (MSSP) or large enterprises with intricate network infrastructures, managing multitenancy configurations in IBM QRadar SIEM can be a daunting task.

To address this challenge, we are leveraging the power of watsonx Assistant to introduce a seamless and automated solution for multitenancy configuration in QRadar. This innovative approach allows users to perform all necessary configurations through a conversational interface, eliminating the need to navigate the traditional QRadar UI.

Core functionalities

The solution involves developing a chat assistant inside the QRadar application that provides an administrative interface. This interface will enable administrators to input key elements such as tenants, associated domains, log sources, security profiles, roles, and users. The goal is to streamline the creation of new tenants with a one-click process, ensuring an integrated and efficient approach.

Component technologies

The following technologies are components of our solution:

IBM QRadar SIEM

IBM Security QRadar is a market-leading Security Information and Event Management (SIEM) solution that creates prioritized, high-fidelity alerts in real time by correlating analytics, threat intelligence, and network and user behavior anomalies to help security analysts stay focused on investigating and remediating the right threats. QRadar SIEM makes it easy to remediate threats faster and helps clients catch threats.

watsonx Assistant

IBM watsonx Assistant is a conversational artificial intelligence platform designed to help you overcome the friction of traditional support.

Powered by trusted large language models (LLMs), watsonx Assistant enables you to build AI-powered voice agents and chatbots to deliver automated self-service support across all channels and touch-points and seamlessly integrate with other business tools.

IBM Cloud Code Engine

IBM Cloud Code Engine is a fully managed, serverless platform. It manages and secures the underlying infrastructure for container images, batch jobs, source code, or functions. You don't need to size, deploy, or scale container clusters yourself, and no networking skills are required.

OpenAPI

The OpenAPI initiative establishes an open standard for describing and documenting REST APIs. An OpenAPI document defines the resources and operations that are supported by an API, including request parameters and response data, along with details such as server URLs and authentication methods.

An OpenAPI document describes a REST API in terms of paths and operations. A path identifies a particular resource that can be accessed by using the API (for example, a hotel reservation or a customer record). An operation defines a particular action that can be performed on that resource (such as creating, retrieving, updating, or deleting it).

OpenAPI specifies all of the details for each operation, including the HTTP method that is used, request parameters, the data included in the request body, and the structure of the response body.

Challenges

• Complex configuration: Multitenancy setup in QRadar requires detailed configuration steps that are complex and error-prone.
• Resource intensity: Manual configuration demands significant time and resources from IT teams.
• Security concerns: Ensuring secure isolation of tenant data is critical to prevent potential breaches and data leaks.

Best practices

• Automated configuration: Drastically reduces setup times by automating complex multitenancy configurations.
• Single pane of glass: Simplifies configuration tasks within a single, intuitive interface.
• Conversational guidance: Provides step-by-step assistance, reducing the learning curve for administrators.
• Scalability: Easily accommodates additional tenants and configuration changes as organizations grow.
• Reduced manual effort: Frees up IT and security teams to focus on higher-value activities.

Prerequisites for multitenancy configuration in IBM QRadar SIEM

Before diving into the multitenancy configuration process using Watsonx Assistant, you need to have a couple of prerequisites in place to ensure a smooth and efficient setup and maximize the benefits of automation:

• Create log source groups: Be sure to set up your log source groups ahead of time, tailored to fit the specific needs of your environment. These groups define the data sources that will be assigned to each tenant during the setup. When you initiate the configuration, watsonx Assistant will present you with these predefined groups to select from. By having them ready, you can quickly and confidently choose the correct ones, eliminating any potential delays or confusion.
• Configure user roles: You need to preconfigure user roles to effectively manage access. Specifically, define the roles for 'tenant_user' and 'tenant_admin' in advance to ensure that you can assign the appropriate permissions during tenant setup. This will streamline the process and reinforce security by maintaining strict role-based access controls across your environment.

By preparing these prerequisites, you will be well-equipped to leverage watsonx Assistant's capabilities for a more efficient and error-free multitenancy configuration process in IBM QRadar SIEM.

Workflow

Now, let’s delve into the step-by-step workflow that illustrates how our solution simplifies the multitenancy configuration process using watsonx Assistant. This approach not only streamlines the setup but also ensures that you can focus on higher-value tasks. Here’s how it works:

• Starting a session: The process begins when you launch watsonx Assistant to initiate a new tenant configuration. This user-friendly interface sets the stage for a seamless experience.
• Simple prompts: Once the session is active, the assistant will prompt you for essential details, such as the tenant name and domain. These basic inputs are all that’s required to get started.
• Log Source groups made easy: Instead of navigating through QRadar’s complex interface to set up log sources manually, the assistant provides a convenient list of existing log source groups. You can easily select the appropriate sources that you need for the tenant configuration, streamlining this crucial step.
• Automated domain creation: With the necessary details provided, the assistant invokes a custom extension that has been deployed in IBM Code Engine. This extension interacts directly with QRadar’s APIs to create the tenant's domain and configuration in one seamless operation, eliminating the need for manual input.
• Security profiles without the hassle: Next, the assistant takes care of creating a security profile for the tenant. Using IBM Code Engine, it inputs this information directly into the QRadar database, significantly reducing the effort required on your part.
• Deploy and confirm: After setting up the security profile, the assistant deploys the configuration changes. It verifies that everything is set up correctly, ensuring that the configuration aligns with your requirements.
• User creation, just like that: If there’s a need to create a new user for the tenant, the assistant simplifies this task as well. It invokes another custom extension to add the new user and assign them the correct permissions, all with minimal user intervention.
• Session complete: When all tasks are completed, the assistant confirms that the setup is finished. You can confidently proceed, knowing that everything is in place and operational.

Workflow diagram

The following diagram illustrates the workflow between components in the solution:

Demo video

The following video demonstrates how to streamline your QRadar multitenancy configuration using watsonx Assistant:

Deploying QBot for QRadar

The QBot for QRadar details are stored in a GitHub repository. To access installation instructions, download the app and install it on IBM QRadar.

You can download the app from this GitHub repository.

Summary

By implementing watsonx Assistant for multitenancy configuration in IBM QRadar SIEM, you can streamline and automate the management of a complex security environment. By leveraging a conversational interface, you can efficiently configure tenants, domains, log source groups, security profiles, and users without accessing the traditional QRadar UI.

This solution enhances security, reduces setup times, minimizes manual effort, and ensures consistent and compliant configurations. The workflow involves step-by-step guidance from the assistant, making the process intuitive and user-friendly, ultimately improving resource allocation and scalability for MSSPs and large organizations.

Next steps

To learn more about the technologies used to create this chat assistant, see the following resources:

• IBM watsonx Assistant
• IBM Security QRadar SIEM
• QRadar API endpoint
• IBM Cloud Code Engine