IBM Cloud Pak for Security is an open security platform that connects to your existing data sources to generate deeper insights and enables you to act faster with automation.
Now introducing The SOAR for Managed Security Service Providers (MSSP) Feature enhancements in
Case Management and
Orchestration & Automation which provides the ability to manage multiple customers' cases from a single dashboard. Customer case data is stored separately but can be accessed and viewed from one dashboard.
More than half of security technology purchases are influenced by MSSPs, led by a widening skills gap and triggered by more advanced attacks, tougher compliance requirements, and a need to innovate quickly. In a complex environment, more MSPs are partnering to take advantage of that opportunity. here we will see how & the intent of this blog is to showcase how you can integrate QRadar & CP4S in an MSSP SOC to offer services to multiple clients and at the same time ensure confidentiality, integrity, and availability.
NOTE: Please use the same version of Products & apps to get similar results.
Version CheckList:
| Requirement |
Product/ APP |
version |
| QRadar Instance with MSSP tenants |
QRadar 7.4.1 Patch 2 + (SIEM) |
QRadar 7.4.1 Patch 2 + |
| QRadar App For Escalating Offense to CP4S |
IBM SOAR QRadar Plugin - QRadar v7.4.1FP2+ (SIEM APP available on App Exchange)
|
4.0.7 |
| CP4S Instance with MSSP Accounts |
Cloud Pak For Security - 1.10.3 |
1.10.3
|
Here are some steps which should be on your checklist to replicate the same in your environment.
- Install the Latest version of the SOAR App for QRadar - IBM SOAR QRadar Plugin - QRadar v7.4.1FP2+ (SIEM APP available on App Exchange)
- MSSP Setup on QRadar with at least 2 Tenants.
- 2 QRadar Offense mapped in 2 different domains.
- CP4S version 1.10.3 with at least 1 Provider & 2 Standard accounts under MSSP configuration.
- Configure IBM SOAR QRadar Plugin - QRadar v7.4.1FP2+ for integrating QRadar with CP4S
- Remember to do a full deploy & push configuration in QRadar & CP4S SOAR after verifying & saving the SOAR App escalation template.
Detailed step-by-step Procedure:
-
Install the Latest version of the SOAR App for QRadar - IBM SOAR QRadar Plugin - QRadar v7.4.1FP2+ (SIEM APP available on App Exchange)
- Generate auth Token for SOAR App and Perform full deploy
- create token without expiry
- Download & install the App from AppExchange IBM SOAR QRadar Plugin - QRadar v7.4.1FP2+ or install it from QRadar assistant.
-
MSSP Setup on QRadar with at least 2 Tenants.
- Go to Domain Management > add new domains & attach appropriate LogSources or LogCollector
- Now Create two tenants to map them with the domain.
-
Two different QRadar Offense mapped in 2 different domains.
- If different Log Sources are attached to two different Domains, the offense will appear in different domains automatically as soon as the Co-Relation-Rules triggers. I have used the Experience center app on QRadar to generate dummy logs and offenses, so they can be escalated for demo purposes.
- Go to Domain Management > add new domains & attach appropriate LogSources or LogCollector
- Now Create two tenants to map them with the domain.
Note: A domain can be equipped with multiple Log sources, Event Collectors, Custom Properties, or even disconnected Log Collectors also.
-
CP4S version 1.10.3 with at least 1 Provider & 2 Standard accounts under MSSP configuration.
-
- Login to CP4S using an Account that has System Administration Privileges and creates two Providers account.
- Now assign users to the Provider account, [Account which is creating the Prover account will be assigned as a user ].
- Now switch to Provider accounts and create Standard Accounts
- Push the configuration from the Provider account to the Standard accounts, as described in Pushing configuration changes.
Note: consider below example topologies to understand the MSSP account hierarchy
 |
-
- QRadar Destination Name: <your Desired Name>
- Authorized Service Token: <Token generated from QRadar for this APP>
- SOAR Server URL: <https://cp4s.example-0000.us-south.containers.appdomain.cloud>
- CP4S mode: <Enable this checkbox>
- CP4S Connection Parameters
- REST URL: <cases-rest.cp4s.test-example-0000.us-south.containers.appdomain.cloud>
- STOMP Host: <cases-stomp.cp4s.test-example-0000.us-south.containers.appdomain.cloud>
- STOMP Port: 443
- Authentication method: Select API key > go to Provider Account >click on Menu > Application settings > Permission & Access
- API Key ID: <api-key-id>
- API Key Secret: <api-key-id>
- Multiple Organization Support: <enable this checkbox>
- Configuration Organization Name: <UUID of Provider Account>
- SOAR Timeout (seconds): <Leave it to default as 30 sec>
- Connect securely: <Uncheck/Don't Select this box>
- Enable Configuring SOAR: <Enable this checkbox>
- Need to configure a proxy? <Uncheck/Don't Select this box, unless you have a Proxy setup in your environment>
- Verify & configure the configuration then Save save.
-
Remember to do a full deploy & push configuration in QRadar & CP4S SOAR after verifying & saving the SOAR App escalation template.
End Result verification:
After escalating two offenses to CP4S:
Find the below documentation links:-
CP4S MSSP Documentation
App Exchange
If you have any questions regarding any of the points mentioned above or want to discuss this further, feel free to get in touch.
Anuj Shrivastava : @Anuj Shrivastava - ashrivastava@in.ibm.com
Betala R. Shanbhag : @Betala Shanbhag - beshanb1@in.ibm.com