IBM QRadar Install

Updated 2 months ago by Elvis Hovor

This document explains how to install and configure the TruSTAR App for IBM QRadar. 

How TruSTAR works with QRadar

From within QRader, you can query TruSTAR enclaves to return IOCs that are stored in one or more QRadar reference sets. You can then use the information in those reference sets to create QRadar rules. 

When one of those rules is invoked, it creates an event or an offense. You can automatically or manually send those events or offenses to TruSTAR for enrichment. Any information obtained from TruSTAR is loaded back into the event or offense in QRadar for deeper investigation. 

TruSTAR Terms

  • Station: The TruSTAR threat intelligence management SAAS platform. 
  • Enclaves: Data repositories in the Station platform. Each data source imported by Station resides in its own enclave. For more information on Enclaves, see "What is an enclave."
  • Observable: Artifacts found on a network or operating system that indicate a likely intrusion. Typical observables are virus signatures, IP addresses, MD5 hashes of malware files, URLs, or domain names. 
  • IOC: Indicator of Compromise. Another term for Observables.

QRadar Terms

  • Event: The log of some particular action on a network device at a point in time. Examples of such actions can include an SSH login on a UNIX server, or a Firewall Deny logged by a perimeter firewall. 
  • Offense: A collection of related events. For example, an SSH login repeated on the same UNIX server over a short period of time can be defined as an offense. 
  • Reference Set: Data stored in a simple list format. In the TruSTAR integration, reference sets contain IOCs from TruSTAR. You can use this data in searches, filters, rule test conditions, and rule responses.

Components

The integration requires an IBM QRadar installation and the TruSTAR QRadar application.

Requirements

The TruSTAR integration works with IBM QRadar version 7.2.8 or higher.

Roles and Capabilities

Depending on the account permissions you have in QRadar, you can access different features of the TruSTAR App. The Admin account must have the following QRadar privileges:

  • TruSTAR Application
  • IP Right Click Menu Extension Capabilities

Admin users can configure the TruSTAR plug-in, manually submit events or offenses, and hunt for information. Non-Admin users cannot alter the TruSTAR configuration but they can perform all other tasks. 

Installation Options

You can either download the TruSTAR app from the IBM X-Force App Exchange or you can manually install it by downloading the bundle directly from TruSTAR. Manual installation is covered in the IBM QRadar FAQ

The most recent version of the TruSTAR App for IBM QRadar is version 1.0.1, which is not yet available from the QRadar extension management feature. To install this newest version, please follow the manual installation instructions in the IBM QRadar FAQ.

Installing

To install the TruSTAR plug-in, follow these instructions.

  1. Navigate to the QRadar Admin tab.
  2. Click Extension Management.
  3. Click Add and select the TruSTAR App bundle.
  4. Click Install Immediately, then click OK to begin the installation. 

You now see the TruSTAR App settings on the QRadar Admin page and GUI buttons for TruSTAR actions you can take.  

Configuring

Before you begin using the TruSTAR App, you must first configure it using a QRadar Admin account. 

QRadar_Install_Figure1

Parameter

Required

Description

QRadar Authorized Service Token

Yes

To retrieve this token:

  1. Navigate to Admin-> Authorized Services.
  2. Click Add Authorized Service.
  3. Enter the service name.
  4. Select Admin as User Role and Admin as Security Profile, then check No Expiry.
  5. Click Create Service.
  6. Click Deploy Change on the Admin Page toolbar.

TruSTAR Server URL

Yes

The TruSTAR station URL from which data is collected by executing API calls. Set this parameter to https://station.trustar.co 

TruSTAR Access Key

Yes

Used to make API calls. You can find this Key in the TruSTAR Station web interface under Settings-> API. How to find your API Key

TruSTAR Secret Key

Yes

Used when making API calls. Available under Settings-> API on TruSTAR Station. How to find your API Secret Key

Enclave IDs for Pull (Hunt)

Yes

The TruSTAR Enclave ID(s) where you want to search for IOC enrichment. If left blank, it will search all TruSTAR enclaves you have access to.To specify multiple enclaves, separate each enclave ID with a comma and no spaces:

Best Practice:

  • Avoid importing from more enclaves than you need to as each one takes time to process.

Enclave IDs for Submit

Yes

The TruSTAR Enclave IDs to submit events and offences to.To submit data to multiple enclaves, separate each enclave ID with a comma and no spaces:

Retrieving your Enclave IDs

Max Events per Offense

Yes

The number of events to process for a single offense. The maximum is 200 Events.

Offense Exclusion Filter

No

The Offense sources to filter out when submitting Offenses to TruSTAR. To enter multiple values, separate each value with a comma; for example: 10.0.0.1,User Logout

Event Exclusion Filter

No

The event types to filter out when submitting events to TruSTAR. To enter multiple values, separate each value with a comma; for example: eventA,eventB

An event is anything triggered by a rule, for example, an SSH login from a UNIX server or a firewall rule being triggered. You can learn more about QRadar filters here.

Enable Auto Submission

No

Automatically sends Offenses to TruSTAR. You can set these options:

  • Interval between submissions (Poll Interval). The default value is 5 minutes.
  • Maximum number of Offenses to process for each interval. The maximum is 200 Offenses. 

IOC Feed

No

Automatically collects TruSTAR IOCs into QRadar reference sets. You can choose the interval between checks by setting the Poll Interval value. 

You can learn more about QRadar reference sets here

Enable/Disable Proxy

No

If you use a proxy, you must specify the following information: 

  • IP/Hostname (do not include http/https)
  • Port

Require Authentication for Proxy

No

If you have a proxy enabled and it requires authentication, then select this checkbox. You must provide a username and password for the proxy server. 

Best Practices

To optimize using the TruSTAR App with QRadar, here are some suggestions. 

  • Create an email account specifically for your QRadar integration (ex: soc_trustar_qradar_integration@customercompany.com).
  • Create a TruSTAR Station account tied to that QRadar integration email address. You will need access to that email account so you can open the account verification email TruSTAR Station will send to it.  Your Qradar instance will use this Station account’s API credentials. 
  • Check that the IP addresses supporting traffic to Station are whitelisted in your firewall or proxy rules. The current list of IP addresses are listed near the bottom of this support page: https://support.trustar.co/article/n2h2ylhiqo-faq
  • Check your TruSTAR API limits. Learn how in this support document.
  • Avoid importing from more enclaves than you need to as each one takes time to process.


How Did We Do?