IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

LDAP App and Reference Table

  • 1.  LDAP App and Reference Table

    Posted 06/18/20 05:15 AM
    Hey Community,

    I have the following Question.
    I use both LDAP APP and the Reference Data Management App.
    I just want to check whether I can see if the elements of that reference table are contained in an event and trigger an offense.

    1st question:

    I get my Domain Users from the Domain Controller and they are included in a reference Table.

    It works!



    However, I try to use them in a rule



    I can't select any Reference Table. The drop down menu is empty. From the picture above you can see that there are reference tables.

    This behavior is found on other systems with different Qradar Versions 7.3.* and 7.4


    2nd question:

    I tried to solve the aforementioned problem using another test that is available for a reference map of sets. I then generated a map of sets through the LDAP Import App.



    However, the test available for that only allows me to search to match an event property to a key and another event property to a value.



    I could use an Alias to match the LDAP Attribute to an Alias like this:

    The problem is that in the Event Payload there is not property whose value is AccountName. The property is called "AccountName", but the rule test looks for the value of the property and not the name of the property.  That's why my rule would never match. If I changed the alias to something like 4771, which is an Event ID, I had then a reference map of sets whose key would be 4771 and the values the accountnames. My rule would then look for EventID as key, which would match (4771). But this solution doesn't not seem feasible. I could change the Microsoft or Linux DSMs to include a property X whose value would be Y and Y would be the key for my reference maps of sets. This sounds more like a workaround than a real solution.

    In fact, I just wanted to check the values of a reference map of sets whether something is there or not regardless of the key, because in my example, the key is not present in the events.

    Do you have some ideas?
    Thanks in advance
    Regards,

    Bruno



    ------------------------------
    Bruno Oliveira
    ------------------------------


Related Content