Adding an HCL BigFix vulnerability scanner (formerly known as IBM BigFix)

QRadar accesses vulnerability data from HCL BigFix by using the SOAP API that is installed with the Web Reports application.

Before you begin

HCL BigFix is formerly known as IBM BigFix. The name remains as IBM BigFix in QRadar.

About this task

You can add multiple HCL BigFix scanners in QRadar. Each scanner requires a different configuration for each CIDR range that you want the scanner to scan.

Use multiple configurations for a single HCL BigFix scanner to create individual scanners that collect result data from specific locations or vulnerabilities for specific types of operating systems.

Procedure

  1. Click the Admin tab.
  2. Click the VA Scanners icon.
  3. Click Add.
  4. In the Scanner Name field, type a name to identify your HCL BigFix scanner.
  5. From the Managed Host list, select an option that is based on one of the following platforms:
    • On the QRadar Console, select the managed host that is responsible for communicating with the scanner device.
    • On QRadar on Cloud, if the scanner is hosted in the cloud, the QRadar® Console can be used as the managed host. Otherwise, select the data gateway that is responsible for communicating with the scanner device.
  6. From the Type list, select IBM BigFix.
  7. In the Hostname field, type the IP address or hostname of the HCL BigFix scanner that contains the vulnerabilities that you want to retrieve with the SOAP API.
  8. In the Port field, type the port number that is used to connect to the HCL BigFix scanner by using the SOAP API.
    By default, port 80 is the port number for communicating with HCL BigFix. If you use HTTPS, you must update this field with the HTTPS port number. For most configuration, use port 443.
  9. Select the Use HTTPS checkbox to connect securely with the HTTPS protocol.

    If you select this checkbox, the hostname or IP address that you specify uses HTTPS to connect to your HCL BigFix. When you use HTTPS, a server certificate is required. Certificates must be placed in /opt/qradar/conf/trusted_certificates directory. QRadar supports certificates with the following file extensions: .crt, .cert, or .der. You can either use SCP or SFTP to manually copy the certificate to the /opt/qradar/conf/trusted_certificates directory. Alternatively, you can download a copy of the certificate directly from the QRadar host. To do this, use SSH to connect the host and type the following command: /opt/qradar/bin/getcert.sh [IP_or_Hostname]. You can also add a port number to the command. The default port is 443. A certificate is then downloaded from the specified hostname or IP and placed into the /opt/qradar/conf/trusted_certificates directory in the appropriate format.

  10. In the Username field, type the username of the account that has access to HCL BigFix.
  11. In the Password field, type the password.
  12. To configure a CIDR range for your scanner:
    1. In the text field, type the CIDR range that you want this scanner to scan or click Browse to select a CIDR range from the network list.
    2. Click Add.
  13. Click Save.
  14. On the Admin tab, click Deploy Changes.