IBM Developer

Tutorial

Integrate QRadar SIEM with UAX

Two methods let you connect QRadar SIEM with the unified analyst experience

By Rahul K.P., Anuj Shrivastava

On this page

In the realm of cybersecurity, integrating various security tools and platforms is essential for achieving comprehensive visibility and effective threat management. IBM Security QRadar Suite Software, in conjunction with IBM QRadar, provides centralized security insights and operations. This tutorial is designed to walk you through the steps necessary to connect QRadar apps with the unified analyst experience (UAX) in the QRadar Suite using the QRadar Proxy configuration. You'll learn how to configure the QRadar Proxy to facilitate communication between these platforms, enabling seamless integration of QRadar data into the QRadar Suite and other relevant interfaces.

This tutorial also shows you how to perform federated searches and integrate asset database details using the QRadar data source configuration and Connected Assets and Risk (CAR) connector configuration. By synchronizing asset data and using federated search capabilities, you can take a holistic approach to security data management and analysis. This integration enhances your QRadar Suite functionality and provides a unified view of your security landscape to help you make informed decisions and respond efficiently to threats.

This tutorial shows you how to connect IBM Security QRadar SIEM with UAX in two ways:

  • As a data source or asset connector
  • Using a proxy connetion with QRadar SIEM

Prerequisites

Following are prequisites for data source connection. The connector requires that the following content extensions are installed on your QRadar environment:

To connect QRadar to UAX, choose one of the two methods and complete the steps:

Method 1: Connect to QRadar SIEM as a data source

Connect the IBM Security QRadar data source to IBM Security QRadar Suite Software to enable your applications and dashboards to collect and analyze QRadar security data. Universal Data Insights connectors enable federated search across your security products.

  1. Log in to IBM Security QRadar Suite Software.
  2. From the menu, click Connections > Data sources. datasource1.png
  3. On the Integration Data Sources page, in the Select Data Source section, click Connect a Data source.
  4. Search for the QRadar tile, select IBM QRadar and QRadar on cloud, and click Next. datasource2.png
  5. On the Connection details page, configure the following parameters:
    • Data source name
    • Data source description
    • Edge gateway: If you have a firewall between your cluster and the data source target, use the edge gateway to host the containers. In the Edge gateway field, specify an edge gateway to host the connector.
    • Management IP address or Hostname
    • Host port
  6. Set the query parameters to control the behavior of the federated search query on the data source:
    • Concurrent search limit
    • Query search timeout limit
    • Result size limit
    • Query time range Note: If you increase the Concurrent search limit and the Result size limit, a greater amount of data can be sent to the data source, which increases the strain on the data source. Increasing the query time range also increases the amount of data. datasource3.png
  7. In the IBM QRadar Certificate field, enter your certificates:
    1. Access the QRadar CLI.
    2. Enter the following command for the root certificate:
      cat /opt/qradar/ca/www/root-qradar-ca_ca.crt
    3. Copy the contents between the BEGIN and END certificate, including the lines:
      -----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
    4. Repeat the above steps for the intermediate certificate. Note: If you changed your default QRadar certificates, you must specify the certificates that you imported. If you changed your QRadar SSL certificates, your new Root and Intermediate Certificates are typically at /etc/pki/ca-trust/source/anchors/<file_name>.crt.
  8. (Optional) Attribute mapping: Map the STIX attributes to Data Source Connector attributes for federated Search. datasource4.png
  9. On the Connection configurations page, configure identity and access:
    1. Click Add a configuration.
    2. In the Configuration details window, configure the following parameters:
      • Configuration Name
      • Configuration Description
      • Authorized services token: Generated from the QRadar console's Admin > Authorized Service section
    3. Click Add.
    4. Click Done. datasource5.png

After you connect a data source, it might take up to 30 seconds to retrieve the data. Before the full data set is returned, the data source might display as unavailable. When the data is returned, the data source shows as being connected, and a polling mechanism occurs to validate the connection status.

datasource6.png

Method 2: Connect to QRadar SIEM as an asset data source

The IBM QRadar Connected Assets and Risk (CAR) connector runs in the IBM Security QRadar Suite Software cluster. The connector incrementally synchronizes the contents of the QRadar asset databases with the data that is managed by the CAR service.

  1. Log in to IBM Security QRadar Suite.
  2. From the menu, click Connections > Data sources.
  3. On the Integration Data Sources page, in the Select Assets section, click Connect an Asset. asset1.png
  4. Search for the QRadar tile, select IBM QRadar and QRadar on cloud, and click Next. alt
  5. Define the general details to allow IBM Security QRadar Suite to connect to the assets:
    • Connector name
    • Connector Description
    • (Optional) Edge gateway: Specify an edge gateway if the connection is to run on an edge gateway.
    • Frequency: Select how frequently this connection will pull data from the asset.
    • Management IP address or Hostname
    • Host port
  6. Repeat step 7 from the data source configuration procedure to obtain the root and intermediate certificates. Then, paste them into the Connection Certificate field. alt
  7. Repeat step 10 from the data source configuration procedure to configure identity and access.
  8. Click Add and then click Done. alt

When the configuration is successful, you will see the status as Connected on the "Data sources" page.

alt

For more details, see QRadar data mapping and Enabling debug level logging for a QRadar Connected Assets and Risk connector in the IBM Cloud Pak for Security documentation.

Connect to QRadar apps and APIs

IBM QRadar Proxy provides communication between IBM Security QRadar Suite Software and IBM QRadar. This communication uses APIs to pull QRadar data into the QRadar SIEM dashboards and other dashboards with QRadar data. It also provides access to supported versions of QRadar apps, such as QRadar User Behavior Analytics, within the context of QRadar Suite Software.

Preventing lock-out from QRadar

Administrators must change the default configuration in QRadar before they integrate QRadar Suite Software and QRadar. Otherwise, the IBM QRadar Proxy app might be locked out for all QRadar Suite Software users.

  1. Log in to the QRadar Console, and go to Admin > Authentication > General Authentication Settings > Lockout Management. alt alt
  2. By default, Host Lockout is enabled, and the default number of login attempts is 5. If the QRadar Suite Software cluster uses Network Address Translation (NAT), add the routable public-facing IP address of the NAT to the Login Host Allowlist.
  3. If the QRadar Suite Software cluster is not NAT-enabled and the worker node IP addresses are routable to the QRadar IP, complete the following steps:
    1. Log in to the Red Hat OpenShift cluster and issue the following oc command:
      oc describe nodes -l node-role.kubernetes.io/worker | grep InternalIP: | awk {' print $2 '}
    2. Add the list of IP addresses that are returned from the command to the Login Host Allowlist.
  4. Enable Account Lockout to prevent login attempts after a configured number of failed attempts for a single user account.
  5. Click Save Settings. alt

Make a proxy connection with QRadar SIEM and UAX

Users with an Administrator role for IBM QRadar Proxy can connect to an IBM QRadar deployment. This will enable IBM Security QRadar Suite Software to connect to QRadar APIs and supported versions of QRadar apps from that deployment.

  1. From the QRadar Suite home page, click Menu > Connections > QRadar Proxy. alt
  2. Under connection details, define the details of the IBM QRadar deployment:
    • Connection Name
    • Connection Description
    • Management IP Address or Hostname
    • Host Port
    • Service Authentication Token: You can get the token from the Authorized Services window in QRadar.
  3. Add the QRadar authentication credentials for the deployment:
    1. Select the checkbox to use the Service Authentication Token that you entered in the Connection Details section instead of entering your own user token.
    2. If you want to access supported QRadar apps, such as QRadar User Behavior Analytics, provide your own QRadar username and password, regardless of the authentication token you entered in the previous step. (Your users must enter their own username and password.)
  4. For a self-signed certificate, repeat step 7 from the data source configuration procedure to obtain the root and intermediate certificates. Then, paste them into the Connection Certificate field. alt
  5. In the Server Name Indicator section, provide the IP for your QRadar console. alt
  6. Click Save, and then verify that the connection is successful by checking the status in the navigation panel. alt

Validate the QRadar Proxy configuration

You can validate the QRadar Proxy configuration by accessing the UBA, NTA, and Detection and Response Center from the QRadar Suite Platform.

  1. Go to the QRadar Suite home page.
  2. Click the hamburger menu and access UBA, NTA, and DRC. alt

Note: When properly configured, the QRadar proxy facilitates seamless data synchronization between designated applications and their counterparts accessed through the QRadar Suite platform, offering users a unified view of their security information.

UBA overview

alt

Network Threat Analytics overview

alt

Detection and Response Center overview

alt

Summary

This tutorial has guided you through connecting QRadar apps to the QRadar Suite using the QRadar Proxy configuration, performing federated searches, and integrating asset database details with QRadar data source and CAR connector configurations. These connections can enhance your organization’s security data synchronization and threat analysis capabilities.

Next steps

Now that you've completed the tutorial, continue to learn about QRadar Suite and the unified analyst experience from the following resources: