IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  how to get http receiver protocol via https working?

    Posted 07/20/20 07:53 AM
    Hello,

    I'm trying to post data to http receiver, but when using https it simply doesn't respond anymore after sending the data, please find the command I'm using below:
    curl -k --header "Content-Type: application/json" --request POST -vvv --data-binary '{"foo":"bar"}' https://10.105.34.57:12469

    The protocol dialog:
    * About to connect() to 10.105.34.57 port 12469 (#0)
    * Trying 10.105.34.57...
    * Connected to 10.105.34.57 (10.105.34.57) port 12469 (#0)
    * Initializing NSS with certpath: sql:/etc/pki/nssdb
    * skipping SSL peer certificate verification
    * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    * Server certificate:
    * subject: O=SyslogTLS_Server,CN=*
    * start date: Apr 25 10:34:04 2018 GMT
    * expire date: Apr 22 10:34:04 2028 GMT
    * common name: *
    * issuer: O=SyslogTLS_Server,CN=*
    > POST / HTTP/1.1
    > User-Agent: curl/7.29.0
    > Host: 10.105.34.57:12469
    > Accept: */*
    > Content-Type: application/json
    > Content-Length: 13
    >
    * upload completely sent off: 13 out of 13 bytes


    That's it. What am I doing wrong here? Everything is working using http instead of https in the protocol setting of the related log source.


    Thank you in advance,
    Stefan

    ------------------------------
    Stefan Haunß
    ------------------------------


  • 2.  RE: how to get http receiver protocol via https working?

    Posted 07/21/20 04:22 AM
    When switching "communication type" to http it works as follows (please find also screenshots attached):
    curl -k --header "Content-Type: application/json" --request POST -vvv --data-binary '{"foo":"bar"}' http://10.105.34.57:12469
    * About to connect() to 10.105.34.57 port 12469 (#0)
    * Trying 10.105.34.57...
    * Connected to 10.105.34.57 (10.105.34.57) port 12469 (#0)
    > POST / HTTP/1.1
    > User-Agent: curl/7.29.0
    > Host: 10.105.34.57:12469
    > Accept: */*
    > Content-Type: application/json
    > Content-Length: 13
    >
    * upload completely sent off: 13 out of 13 bytes
    < HTTP/1.1 200 OK
    < Date: Tue, 21 Jul 2020 08:16:13 GMT
    < Content-length: 13
    <
    * Connection #0 to host 10.105.34.57 left intact
    Received data



    ------------------------------
    Stefan Haunß
    ------------------------------



  • 3.  RE: how to get http receiver protocol via https working?

    Posted 08/07/20 05:11 AM
    anyone got the https receiver working?

    ------------------------------
    Stefan Haunß
    ------------------------------



  • 4.  RE: how to get http receiver protocol via https working?

    Posted 08/13/20 07:55 AM
    nobody uses it? :(

    ------------------------------
    Stefan Haunß
    ------------------------------