IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  MISP integration with QRadar

    Posted 04/21/22 02:52 AM
    Hi,
    I need to integrate the MISP with currently running AIO QRadar, can you please share the steps and procedure how this can be integrated as I have tried following the procedure available at Github but unfortunately that is having errors and integration is not successful.

    ------------------------------
    Farhan Saleem
    ------------------------------


  • 2.  RE: MISP integration with QRadar

    Posted 04/22/22 03:38 AM
    This is timely as I will be doing the same in a about a month.  Any guidance to us will be appreciated.  I believe it is with the Threat Intelligence app using STIX and TAXXI, but I am not sure.  Please confirm for us.

    ------------------------------
    Scott Searls
    ------------------------------



  • 3.  RE: MISP integration with QRadar

    Posted 04/25/22 03:41 AM
    me2 :)

    ------------------------------
    Vladx(x)
    ------------------------------

    Original Message


  • 4.  RE: MISP integration with QRadar

    Posted 04/25/22 05:08 AM
    Hi Scott,

    Yes exactly threat intelligence feeds are collected on STIX, TAXII but we just want to have the visibility how this can be integrated since there are multiple procedures available such as Minemeld and installing dockers .

    We need to have the procedure how misp can be successfully integrated with Qradar.

    ------------------------------
    Farhan Saleem
    ------------------------------

    Original Message


  • 5.  RE: MISP integration with QRadar

    Posted 04/26/22 02:57 AM
    Hi Farhan,

    We actually tried to integrate MISP with the Threat Intelligence app but we were not satisfied with the results.
    The app in my opinion is not really usable feature-wise.

    We are now happy with a script found on Github (https://github.com/syloktools/MISP-QRADAR-REFERENCE-SET-BUILDER), it's pretty straightforward to implement.

    ------------------------------
    MDB
    ------------------------------

    Original Message


  • 6.  RE: MISP integration with QRadar

    Posted 04/26/22 03:44 AM
    Hi Matteo De Bernardin,

    Thanks for sharing the information , can you also please let us know does the shared scripts will create new reference sets in QRadar or will they are able to enrich any existing reference set.

    Thanks in Advance.

    BR,
    Farhan

    ------------------------------
    Farhan Saleem
    ------------------------------

    Original Message


Related Content