IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Empty requests from Qradar Console via proxy

    Posted 02/26/24 11:51 AM

    Hello, Community.

    We are facing strange behavior of Qradar SIEM Console. In our environment Qradar Console communicates with X-Force via proxy. It works fine and we see requests to X-Force resources in proxy logs. But also we are facing strange requests from Console to Console like this:

    <30>Jan 25 14:53:18 <Proxy Hostname> mwg: LEEF:1.0|McAfee|Web Gateway|12.2.2|81|devTime=1706187198000|src=<Qradar Console>|usrName=|httpStatus=407|dst=<Qradar Console>|urlCategories=|blockReason=Authentication Required|url=https://<Qradar Console>|user_agent=|bytes_from_client=87|bytes_to_client=4414|time_stamp=[25/Jan/2024:14:53:18 +0200]|status_code=407|categories=|rep_level=-|media_type=|virus_name=|block_res=81|application_name=|block_list=

    Can you explain such behavior of Qradar SIEM?



    ------------------------------
    Alexandr Martyniuk
    ------------------------------


  • 2.  RE: Empty requests from Qradar Console via proxy

    Posted 02/28/24 04:50 AM

    Hi Alexandr,

    Your McAfee Web Gateway Proxy Server is erroneously identified as a Log Source for event collection. Here are a couple of options to address this issue:

    • Look into whether there's an Auto Discovered Log Source created for it. if YES, consider disabling it.
    • Experiment with turning off syslog logging on the McAfee Web Gateway Server and observe the outcomes. It will establish the assumption.

    If the issue persists, I recommend opening a case with IBM Support to further investigate your environment. Cheers.

    Best regards,

    Kashif



    ------------------------------
    MIAN SALAHUDDIN
    ------------------------------



  • 3.  RE: Empty requests from Qradar Console via proxy

    Posted 02/29/24 06:28 AM

    Hello,

    Thank you for reply. I'd like to clarify. McAfee WG is a log source in our SIEM and we added it deliberately.

    I just don't understand the reason why SIEM makes those requests via proxy. As you can see in event payload example from original post source and destination of the request is Qradar Console itself.

    I will be very grateful, if someone explains me such behavior of Console. Is it ok, or caused by some misconfiguration?



    ------------------------------
    Alexandr Martyniuk
    ------------------------------

    Original Message


  • 4.  RE: Empty requests from Qradar Console via proxy

    Posted 11/11/24 10:42 AM

    Hello @Alexandr Martyniuk,

    i see you have a McAfeeWebGW connected to the QRadar via Syslog? Can you give me a tip on how this was done? The original DSM cannot parse the events in our case.  How is it possible to change the format from CEF to LEEF? Thank you in advance!



    ------------------------------
    Timo Lüllmann
    ------------------------------

    Original Message


Related Content