Configuring JDBC to communicate with QRadar

You must have a Snowflake account to collect information from tables or views that contain event data logs from several database to configure JDBC protocol with your IBM QRadar Console.

About this task

Generate a private and public RSA key pair for Key-Pair Authentication assertion.

Tip: If you are a QRadar on Cloud user and the target collector is either Console or Events Processor, you must open a case and upload the private key (in DER format). The private key is added to the /opt/qradar/conf/trusted_certificates/jdbc directory.

Procedure

  1. Log in to QRadar box that has an openssl command.
    • For a private key, type the following command:
      openssl genrsa -out jdbc_private_key.pem 2048
    • For a public key, type the following command:
      openssl rsa -in jdbc_private_key.pem -pubout -outform DER | base64
  2. Save a copy of the public key. The contents of the public key must be pasted into the corresponding Snowflake user configuration.
  3. Convert the private key to DER format by typing the following command on one line:

    openssl pkcs8 -topk8 -inform PEM -outform DER -in jdbc_private_key.pem -out jdbc_private_key.der -nocrypt

    Note: The file should be protected from unauthorized access by using the file permission mechanism that is provided by your operating system. Ensure that the file has appropriate permissions so that QRadar can read it
  4. Store the private key on your managed host in QRadar.
    1. Create a directory called jdbc in the /opt/qradar/conf/trusted_certificates/ directory in QRadar.
    2. Copy the private key .DER file to the /opt/qradar/conf/trusted_certificates/jdbc directory that you created. Do not store the private key in any other location.
    3. Configure the log source by using only the file name of the private key file in the /opt/qradar/conf/trusted_certificates/jdbc directory. Ensure that you type the file name correctly in the Private Key File Name field when you configure the log source.
      Tip: If you configure the log source before you store the private key, an error message is displayed.
  5. Assign the public key to a Snowflake user (on the Snowflake side). To assign the public key to the user in Snowflake, run an ALTER USER command to set the RSA_PUBLIC_KEY property. For example; 
    ALTER USER example_user SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...
    Note: Please use the contents of the jdbc_public_key.pub file. If available, remove the header and footer lines (-----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----), as well as any line containing "writing RSA key", before you include it in the command.