IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  LDAPS User Data Import - UBA App

    Posted Tue June 06, 2023 08:14 AM

    Hi everyone,

    I was trying to do LDAPS user import through QRadar UBA app and it runs into an internal server error.

    In the error log it was detected as a "Socket connection timeout". Trying to find out the root cause for the issue. Appreciate your help on this.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------


  • 2.  RE: LDAPS User Data Import - UBA App

    Posted Wed June 07, 2023 11:15 AM

    Hi Dushan, is this a QRadar or QRoC installation? If it is a QRoC installation, did you create a Data Gateway Proxy Mapping? LDAPS uses Port 636, did you check the certificate and the FW settings for Port 636? 



    ------------------------------
    Wolfgang Reismann
    IBM Austria
    ------------------------------

    Original Message


  • 3.  RE: LDAPS User Data Import - UBA App

    Posted Wed June 07, 2023 11:21 AM

    Hi Reisman,

    Thanks for the response. 

    This is QRadar on premise distributed architecture with a separate app host. Firewall settings were confirmed and port 636 is enabled in both ways.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


  • 4.  RE: LDAPS User Data Import - UBA App

    Posted Thu July 27, 2023 09:43 AM

    Hi Dushan,

    Did you get this issue resolved? If not I would suggest try taking a wireshark capture and look at which end is resetting the connection. It's either the cert/ciphers or tcp port issue. UBA uses fips certified ciphers so it could be SSL ciphers are not getting negotiated.

    Regards,

    Prince



    ------------------------------
    Prince Prakash
    Product Manager - IBM QRadar
    IBM Security
    ------------------------------

    Original Message


  • 5.  RE: LDAPS User Data Import - UBA App

    Posted Wed August 02, 2023 01:52 AM

    Hi Prakash!

    The issue is not resolved yet. Thanks for the insights. I did not come across this information earlier. I will check this.

    Thanks & regards,

    Dushan.



    ------------------------------
    Dushan Dissanayake Information Security Engineer
    ------------------------------

    Original Message


Related Content