Connecting to an Elasticsearch data source

Connect the Elasticsearch data source to IBM Security QRadar® Suite Software to enable your applications and dashboards to collect and analyze Elasticsearch security data. Universal Data Insights connectors enable federated search across your security products.

1. Log in to IBM Security QRadar Suite Software.
2. From the menu, click Connections > Data sources.
3. On the Data Sources tab, click Connect a data source.
4. Click Elastic Search (ECS), then click Next.
5. Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
   1. Configure the connection to the data source.

      Table 1. Connection parameters

      Parameter	Description
      Data source name	Enter a unique name to identify the data source connection. You can create multiple connections to a data source, so it is useful to clearly set them apart by name. Only alphanumeric characters and the following special characters are allowed: - . _
      Data source description	Enter a description to indicate the purpose of the data source connection. You can create multiple connections to a data source, so it is useful to clearly indicate the purpose of each connection by description. Only alphanumeric characters and the following special characters are allowed: - . _
      Edge gateway	If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway field, specify an Edge Gateway to host the connector. It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
      Management IP address or Hostname	Enter the hostname or IP address of the data source so that the QRadar Suite Software can communicate with it.
      Host port	Enter the port number that is associated with the data source host. The port is 443 by default.
      Indices (Optional)	To search specific Elasticsearch indices, set a single index or multiple indices in a comma-separated list in the Indices (Optional) field. For example: index1,index2. To search all indices, leave the text box empty.

   2. Set the query parameters to control the behavior of the federated search query on the data source.

      Table 2. Query parameters

      Query parameter	Description
      Concurrent search limit	Enter the number of simultaneous connections that can be made to the data source. The default limit for the number of connections is 4. The value must not be less than 1 and must not be greater than 100.
      Query search timeout limit	Enter the time limit in minutes for how long the query is run on the data source. The default time limit is 30. When the value is set to zero, no timeout occurs. The value must not be less than 1 and must not be greater than 120.
      Result size limit	Enter the maximum number of entries or objects that are returned by search query. The default result size limit is 10,000. The value must not be less than 1 and must not be greater than 500,000.
      Query time range	Enter the time range in minutes for the search, represented as the last X minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than 10,000.
      Custom mapping (Optional)	If you need to customize the STIX attributes mapping, click Customize attribute mapping and edit the JSON blob to map new or existing properties to their associated target data source fields.

      Important: If you increase the Concurrent search limit and the Result size limit, a greater amount of data can be sent to the data source, which increases the strain on the data source. Increasing the query time range also increases the amount of data.
6. Optional: If you configured Elasticsearch with a CA certificate, add the certificate.
   1. To confirm that you have a self-signed certificate, you can search the web for ssl decode, then copy and paste the certification into a Certificate Decoder.
      If the Common Name shows localhost.localdomain, then it is a self-signed certificate. Otherwise, it is a signed CA certificate.
   2. If the value of your hostname or IP address does not match the common name value in your certificate, add the hostname to the server that hosts the Edge Gateway.

      Table 3. Adding your hostname to the Edge Gateway server

      If you are running the Edge client

      If you are not running the Edge client

      Run the following command: manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2> Tip: The <ip_address> is the address of the server that you want to access, and <hostname> is the name of the server. If a server has multiple names, you can add each name by using --hostname. You can use --show to see the defined hostnames and --clear to remove a hostname previously set with the manageAppHost command.

      Add the hostname to the server that hosts the Edge Gateway by adding entries to Pod /etc/hosts with HostAliases. To edit the Universal Data Insights worker deployment, run the following command: oc edit deployment udi-udiworker Add the following information to the host deployment HostAliases, in the spec.template.spec section: hostAliases: - hostnames: - qradar.iseccs.local ip: <1.2.3.4> For more information, see Adding entries to Pod /etc/hosts with HostAliases (https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).

   3. Copy the certificate details and paste it in the space that is provided.
7. Click Add a configuration.
   1. Configure identity and access.

      Table 4. Configuration parameters

      Parameter	Description
      Configuration Name	Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description	Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Username	Establish authentication to access the Elasticsearch API. To establish the connection with basic authentication, enter a Username and Password.
      Password
      Access Token (Token Based Access)	Establish authentication to access the Elasticsearch API. To establish the connection with token-based authentication, enter an Access Token (Token Based Access).
      API Key (Key Based Access)	Establish authentication to access the Elasticsearch API. To establish the connection with API Key authentication, enter an API Key (Key Based Access) and ID (Key Based Access).
      ID (Key Based Access)

   2. Click Add.
   3. To save your configuration and establish the connection, click Done.
8. To edit your configurations, complete the following steps:
   1. On the Data Sources tab, select the data source connection that you want to edit.
   2. In the Configurations section, click Edit Configuration ().
   3. Edit the identity and access parameters and click Save.