IBM Security QRadar

 View Only

  • 1.  Qradar supporting modern authentication or not?

    Posted Tue August 02, 2022 12:31 PM

    Hi All

    Microsoft is turning off basic authentication for following protocols by 1st October 2022.

     

    • MAPI
    • RPC
    • Offline Address Book (OAB),
    • Exchange Web Services (EWS)
    • POP
    • IMAP
    • Exchange ActiveSync (EAS)
    • Remote PowerShell

     Could you please update me Qradar supporting modern authentication or not?

     

    Thanks,

    Siva Pothana



    ------------------------------
    Pothana sivaramakrishna
    ------------------------------


  • 2.  RE: Qradar supporting modern authentication or not?

    IBM Champion
    Posted Mon August 15, 2022 06:00 AM
    Pothana,
    the change you are referring to at https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online affects exchange and other SMTP type connections primarily.
    QRadar is using your AD for external auth using secure options like LDAPS and TLS if you want. Basic authentication (unencrypted) should be disabled in your AD anyway. It depends on your compliance rules and security awareness of your AD admin if you want continue to use it or not. The MS change does not affect this.
    So to answer your question: secure AD based authentication methods is supported.
    However If you are referring to modern authentication methods by thinking of MFA, certificates etc. the answer is no.
    In this case you need to workaround QRadar login by setting up an additonal VPN layer as most users do already.

    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------

    Original Message