IBM Security QRadar

 View Only
  • 1.  Qradar Asset Dashboard?

    Posted Tue November 01, 2022 11:04 AM

    Does anyone have an dashboard created for assets?   Or know of one?   I would love to have a dashboard to look up assets by name/IP and not have to use the Assets tab. 

    Thanks.

    Craig Edgmand
    Oklahoma State University

    ------------------------------
    Craig Edgmand
    ------------------------------


  • 2.  RE: Qradar Asset Dashboard?

    Posted Wed November 23, 2022 08:42 AM
    Hi,

    You can use Dynamic Search to query asset data on a pulse dashboard. You can then use parameters to filter on asset hostname or ip etc...
    https://www.ibm.com/docs/en/qradar-common?topic=widgets-creating-from-dynamic-query-data-source

    You can also use the api client on pulse widgets to display filtered assets data (asset_model/assets)

    I am not aware of any "non pulse" widgets that could help achieve this.

    Cheers.
    Arnaud.



    ------------------------------
    Arnaud Chemla
    Head of security consulting
    Abakus Securité
    ------------------------------



  • 3.  RE: Qradar Asset Dashboard?

    Posted Wed November 30, 2022 03:43 AM

    Hi Arnaud,

    Thanks for mentioning this Feature. Looks useful. However, when we tried to use it with 7.5.0 and Pulse 2.2.9, we never get any results.

    The api endpoints "/api/dynamic_search" are not responding to Pulse or the the Query Builder. Even manual test from /api_doc show no reply.

    Is there anythng that needs to enabled before using dynamic queries ?

    Regards

    Thomas



    ------------------------------
    SIEM-2020
    ------------------------------