IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Advice on creating a dashboard item using flows

    Posted 08/14/19 11:49 AM
    Hi - I am looking for any advice on creating a dashboard item using flows.   We are running the latest QRadar, and also now have QNI in place.

    Use case: I want to have a dashboard that will show any outbound (external) DNS queries that may be rogue. 

    Our DNS setup: Clients query our internal AD domain controllers, and those DC's will forward to DNS server in our DMZ.  Only our DMZ servers are allowed to go external to either google or to our MSP DNS servers.

    What I did so far: I created a reference set for all of our domain controllers.  I created a reference set for DMZ DNS servers.  I created a reference set for allowed external DNS servers (our MSP DNS servers and google). 

    Need help/advice:  From Network Activity, if I query on port 53 traffic, can I exclude traffic that is acceptable by design, and only show external traffic with source NOT from our DMZ DNS servers?   I would also like to make this a dashboard item.   I have done this with Logs, but not with Flows.

    ------------------------------
    Eric Puente
    ------------------------------


  • 2.  RE: Advice on creating a dashboard item using flows

    Posted 08/16/19 09:05 PM
    Hey Eric,

    yeah, this sounds like a straightforward enough query.. Something like

    Select * from flow where flowtype='L2R' and destinationport=53 and NOT REFERENCESETCONTAINS('yourDMZDNS', sourceip)

    ------------------------------
    Christopher Meenan
    ------------------------------



  • 3.  RE: Advice on creating a dashboard item using flows

    Posted 08/17/19 11:26 AM
    "just" block TCP/UDP/53 outward on your firewall is probably the most effective way of preventing this.
     
     
     

    Regards,
    Nico de Smidt
    ________________________________________________
    CTP QRadar Security Intelligence BeNeLux
    https://ibm.biz/QRadarUserGroupNL
    ________________________________________________
    Mobile: +31-(0)6-2294-8769
    E-mail: NdS@nl.ibm.com
    ________________________________________________
    IBM Nederland B.V.
    Johan Huizingalaan 765 (HDK-3)
    P.O. Box 9999
    1006 CE Amsterdam
    Tenzij hierboven anders aangegeven: / Unless stated otherwise above:
    IBM Nederland B.V.
    Gevestigd te Amsterdam
    Inschrijving Handelsregister Amsterdam Nr. 33054214


    ------Original Message------

    Hey Eric,

    yeah, this sounds like a straightforward enough query.. Something like

    Select * from flow where flowtype='L2R' and destinationport=53 and NOT REFERENCESETCONTAINS('yourDMZDNS', sourceip)

    ------------------------------
    Christopher Meenan
    ------------------------------


Related Content