IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  custom action script that calls ms api

    Posted Thu November 30, 2023 08:38 AM
    Reply

    Hi

    I understand the custom action scripts run in chroot()/jail. I have a working script (Confirmed by running on qradar cmdline) that takes the value of a property and performs a POST on a Microsoft API on trigger, however, it is not working as expected as a custom action script. Do I need to make any DNS/network changes to make this work? 

    Also, for troubleshooting purposes, is there a way to manually exc the script e.g. ./script.sh within the jail env? 



    ------------------------------
    QRD
    ------------------------------



  • 2.  RE: custom action script that calls ms api

    Posted Thu November 30, 2023 04:00 PM
    Reply

    If you wanted to see what is going on with the script, you could log in to QRadar as the root user and enable com.q1labs.core.shared.cre.custom.executor in mod_log4j. 

    There is a support tech note for mod_log4j here: https://www.ibm.com/support/pages/qradar-how-use-modlog4jpl. 

    Important: Do not leave the logger running long term. It is best to enable it for an hour, then turn it back on, if required.

    The basics
    Run the script and type your name or initials, press 0, type a time frame (1 hour), then press A and add the class com.q1labs.core.shared.cre.custom.executor and commit and exit. You can then run the Test function in the UI for the custom action and view the debug messages. The logger will disable itself based on the selected timeframe.  



    ------------------------------
    Jonathan Pechta
    IBM Security - Community of Practice Lead
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message


  • 3.  RE: custom action script that calls ms api

    Posted Thu November 30, 2023 10:21 PM
    Edited by QRD Thu November 30, 2023 10:24 PM
    Reply

    Thanks, Dont see any dns resolv issues in the logs. could there be anything else preventing the script from calling the API?

    Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] executeAction(): Attempting to execute action [CustomActionDTO [id=351, name=365Action, description=, script=ScriptMetadataDTO [id=351, name=365Action_v2.sh, path=/custom_action_scripts/customaction_351.script], interpreter=CustomActionInterpreterDTO [id=1, name=Bash, path=/bin/bash], parameters=[CustomActionParameterDTO [id=451, name= Inc ID, parameterType=dynamic, value=Def incidentId, encrypted=false], CustomActionParameterDTO [id=501, name=inc id, parameterType=fixed, value=11066, encrypted=false]]]] for client [qradar.admin].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] buildCommandLine(): Attempting to build command line for action [CustomActionDTO [id=351, name=365Action, description=, script=ScriptMetadataDTO [id=351, name=365Action_v2.sh, path=/custom_action_scripts/customaction_351.script], interpreter=CustomActionInterpreterDTO [id=1, name=Bash, path=/bin/bash], parameters=[CustomActionParameterDTO [id=451, name= Inc ID, parameterType=dynamic, value=Def incidentId, encrypted=false], CustomActionParameterDTO [id=501, name=inc id, parameterType=fixed, value=11066, encrypted=false]]]] with values [{inc id={},  Inc ID={}}]
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] buildCommandLine(): Chroot is enabled. Generating command line with jail [/opt/qradar/bin/ca_jail] and user [customactionuser]
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] buildChrootEnv(): Building chroot env...
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] buildChrootEnv(): Returning chroot env command [[/usr/bin/env, RULE_ID=null, RULE_NAME=null]].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.ParameterResolverFactory: [DEBUG] getResolver(): Attempting to get resolver for parameter type [dynamic]..
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.DynamicParameterResolver: [DEBUG] resolveParameter(): Attempting to resolve parameter [CustomActionParameterDTO [id=451, name= Inc ID, parameterType=dynamic, value=Def incidentId, encrypted=false]] with values [{inc id={},  Inc ID={}}]
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.DynamicParameterResolver: [DEBUG] resolveParameter(): Successfully resolved parameter [ Inc ID] to [null].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.ParameterResolverFactory: [DEBUG] getResolver(): Attempting to get resolver for parameter type [fixed]..
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.FixedParameterResolver: [DEBUG] resolveParameter(): Attempting to resolve parameter [CustomActionParameterDTO [id=501, name=inc id, parameterType=fixed, value=11066, encrypted=false]] with values [{inc id={},  Inc ID={}}]
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.parameter.FixedParameterResolver: [DEBUG] resolveParameter(): Successfully resolved parameter [inc id].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] buildCommandLine(): Successfully built command line.
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] executeAction(): Starting execution for action [351].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Thread-2070808] com.q1labs.core.shared.cre.custom.executor.CustomActionResultHandler: [DEBUG] onProcessComplete(): Invoked with exit value [0] by process [CustomActionProcessId [trackingId=qradar.admin, customActionId=351]].
Dec  1 15:11:10 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-4] com.q1labs.core.shared.cre.custom.executor.CustomActionExecutorImpl: [DEBUG] executeAction(): Finished executing action [351].


  • 4.  RE: custom action script that calls ms api

    Posted Fri December 01, 2023 06:09 AM
    Reply

    To actually test the script (as opposed to the QRadar invocation of the script) in the chroot() environment - you can start a chroot() shell up with a command like:

    # chroot --userspec=customactionuser /opt/qradar/bin/ca_jail

    In this chrooted shell the script can be run locally using one of:

    • /bin/bash /custom_action_scripts/customaction_1.script parm_1 "parm 2"
    • /usr/bin/perl /custom_action_scripts/customaction_2.script parm_1 "parm 2"
    • /usr/bin/python /custom_action_scripts/customaction_3.script parm_1 "parm 2"

    Paul



    ------------------------------
    Paul Ford-Hutchinson
    ------------------------------

    Original Message


  • 5.  RE: custom action script that calls ms api

    Posted Sun December 03, 2023 07:54 PM
    Edited by QRD Sun December 03, 2023 07:54 PM
    Reply

    Thanks Paul, I ran 

    chroot --userspec=customactionuser /opt/qradar/bin/ca_jail

    /bin/bash /custom_action_scripts/customaction_1.script "param value"

    But no output even though the script echo $output. 

    If I run the same script from the console command line it works as expected. 



    ------------------------------
    QRD
    ------------------------------

    Original Message


  • 6.  RE: custom action script that calls ms api

    Posted Tue December 05, 2023 09:49 PM
    Reply

    Had to disable SSL checks as per URL error in custom action script | IBM Security QRadar, I was able to fix the issue by adding -k to the curl command. 



    ------------------------------
    QRD
    ------------------------------

    Original Message


  • 7.  RE: custom action script that calls ms api

    Posted 11 days ago
    Reply

    Hey there, 

    Just following up.  Of course we always want to avoid disabling security checks when possible and after much head scratching, I was able to make a similar idea work by copying the CA bundle into the CHROOT jail environment.  I'm not 100% positive that it will persist after patching but its definitely working now without bypassing any security controls. 

    Note that QRadar uses a jail shell (CHROOT) in order to safely execute custom actions away from production services. This means that the scripts being executed have no permission into the underlying RHEL system. Because of this, the CA bundle must be copied into the CHROOT jail and explicitly referenced in scripts.

    After copying the bundle, I added a variable into my bash script and called it into CURL.  Hope this helps someone else!

    caBundlePath="/home/customactionuser/ca-bundle.crt"

curl --cacert "$caBundlePath" -X POST -H "Content-Type: application/json" -d "do stuff" "https://my.api.internet.orwhatever"
    Steps to Copy CA Bundle:

    This ensures that the script can access the CA bundle and maintain SSL integrity when interacting with external sites.

    cp /etc/pki/tls/certs/ca-bundle.crt /opt/qradar/bin/ca_jail/home/customactionuser/ca-bundle.crt



    ------------------------------
    Paul
    ------------------------------

    Original Message


  • 8.  RE: custom action script that calls ms api

    Posted 8 days ago
    Reply

    Thanks, Paul. This is the right thing to do, we should never use -k in any sort of production environment. You could also include the CA bundle as part of the script configuration to avoid extra CLI accesses.



    ------------------------------
    Rory Bray
    Security and Compliance Architect, Threat Management
    IBM
    ------------------------------

    Original Message