IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IBM Cloud VPC Flow Logs to QRadar

    Posted Mon April 05, 2021 12:15 PM
    This article describes a method for ingesting IBM Cloud VPC flow logs into QRadar. This use case utilizes IBM Cloud LogDNA to store the flow logs so that QRadar can query for flow logs. The GitHub project at https://github.com/IBM/ibm-cloud-vpc-logs-2-qradar walks you through how to setup IBM Cloud and QRadar and has a QRadar DSM available for mapping the VPC Flow logs to QRadar ACL Allow and ACL Deny rules.

       This method uses the IBM QRadar Universal Cloud REST API for ingesting the flow logs. At the time of writing this article the Universal Cloud REST API only allows for posting logs into the Event Pipeline of QRadar. No logs can be posted to the Flow Pipeline of QRadar at this time using this method.
     
    Flow Outline
    1. IBM Cloud VPC Flow Logs are saved to a Cloud Object Storage (COS) bucket.
    2. A IBM Cloud Object Storage trigger detects that a new log has been written.
    3. A function is called to gather the flow log information from the COS bucket and send the data to LogDNA.
    4. QRadar uses the Universal Cloud REST API to query for new VPC Flow Data from LogDNA.

    View of how data flows from VPC Flow logs into QRadar.
    References
    1. Understanding IBM Cloud VPC Flow Logs:
      https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-flow-log-collector
    2. Setting up triggers for changes to IBM Cloud Object Storage bucket where VPC Flow Logs are saved:
      https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_obstorage
    3. Understanding IBM Cloud Log Analysis (LogDNA):
      https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-started
    4. Understanding IBM QRadar Universal Cloud REST API protocol:
      https://www.ibm.com/docs/en/qsip/7.4?topic=configuration-universal-cloud-rest-api-protocol



    ------------------------------
    Matthew Dobbs
    IBM Security
    Atlanta GA
    ------------------------------


  • 2.  RE: IBM Cloud VPC Flow Logs to QRadar

    Posted Thu April 15, 2021 03:41 AM
    Hi

    May be you should post this in blog section ?

    ------------------------------
    Yogesh Talekar
    Manager
    IBM
    ------------------------------

    Original Message


  • 3.  RE: IBM Cloud VPC Flow Logs to QRadar

    Posted Thu April 15, 2021 08:14 AM
    Yogesh,

      I did end up posting this as a blog, I must clicked the wrong place when trying to post originally. I didn't mean to try to make this a discussion. How can we remove this article in the Discussions section?

    Thanks, Matt

    ------------------------------
    Matthew Dobbs
    IBM Security
    Atlanta GA
    ------------------------------

    Original Message


Related Content