IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  LDAPS User Data Import - UBA App

    Posted 06/06/23 08:14 AM

    Hi everyone,

    I was trying to do LDAPS user import through QRadar UBA app and it runs into an internal server error.

    In the error log it was detected as a "Socket connection timeout". Trying to find out the root cause for the issue. Appreciate your help on this.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------


  • 2.  RE: LDAPS User Data Import - UBA App

    Posted 06/07/23 11:15 AM

    Hi Dushan, is this a QRadar or QRoC installation? If it is a QRoC installation, did you create a Data Gateway Proxy Mapping? LDAPS uses Port 636, did you check the certificate and the FW settings for Port 636? 



    ------------------------------
    Wolfgang Reismann
    IBM Austria
    ------------------------------



  • 3.  RE: LDAPS User Data Import - UBA App

    Posted 06/07/23 11:21 AM

    Hi Reisman,

    Thanks for the response. 

    This is QRadar on premise distributed architecture with a separate app host. Firewall settings were confirmed and port 636 is enabled in both ways.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


  • 4.  RE: LDAPS User Data Import - UBA App

    Posted 07/27/23 09:43 AM

    Hi Dushan,

    Did you get this issue resolved? If not I would suggest try taking a wireshark capture and look at which end is resetting the connection. It's either the cert/ciphers or tcp port issue. UBA uses fips certified ciphers so it could be SSL ciphers are not getting negotiated.

    Regards,

    Prince



    ------------------------------
    Prince Prakash
    Product Manager - IBM QRadar
    IBM Security
    ------------------------------



  • 5.  RE: LDAPS User Data Import - UBA App

    Posted 08/02/23 01:52 AM

    Hi Prakash!

    The issue is not resolved yet. Thanks for the insights. I did not come across this information earlier. I will check this.

    Thanks & regards,

    Dushan.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


Related Content