Connecting to an RHACS asset data source

The Red Hat® Advanced Cluster Security (RHACS) Connected Assets and Risk connector can be run in the platform cluster. The connector incrementally synchronizes the contents of the RHACS asset databases with the data that is managed by the Connected Assets and Risk service.

1. Log in to IBM Security QRadar® Suite Software.
2. From the menu, click Connections > Data sources.
3. On the Assets tab, click Connect an asset.
4. Click Red Hat Advanced Cluster Security for Kubernetes, then click Next.
5. Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
   1. In the Connector name field, assign a name to uniquely identify the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
   2. In the Connector description field, write a description to indicate the purpose of the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
   3. In the Edge gateway (optional) field, specify which IBM® Security Edge Gateway to use.

      To use the Edge Gateway to host the containers that are required for communication between the data sources and IBM Security QRadar Suite Software, select an Edge Gateway. The Edge Gateway must be version 1.6 or later. It can take up to 5 minutes to establish the connection to the Edge Gateway.

      Important: If you have a firewall between your IBM Security QRadar Suite Software cluster and the data source target, use the Edge Gateway to host the containers.

      For more information, see Edge Gateway.

   4. In the Frequency field, set how often the connector imports data from the data source, in minutes.
      The value must be an integer.
      For example, a value of 60 causes the connector to run every 60 minutes.
      If the data source doesn't have many assets, or you don't want to import data often, reduce the frequency.
   5. In the Management IP address or Hostname field, enter the RHACS API server URL.
6. Optional: If your QRadar deployment is configured with a privately signed Security Sockets Layer (SSL) certificate, add the connection certificate that you created when you configured the QRadar data source connection. For more information, see Determining whether your certificate is self-signed and Connecting to an IBM Security QRadar data source.
   If the value of your hostname or IP address does not match the common name value in your certificate, add the hostname to the server that hosts the Edge Gateway.

   Table 1. Adding your hostname to the Edge Gateway server

   If you are running the Edge client

   If you are not running the Edge client

   Run the following command: manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2> Tip: The <ip_address> is the address of the server that you want to access, and <hostname> is the name of the server. If a server has multiple names, you can add each name by using --hostname. You can use --show to see the defined hostnames and --clear to remove a hostname previously set with the manageAppHost command.

   Add the hostname to the server that hosts the Edge Gateway by adding entries to Pod /etc/hosts with HostAliases. To edit the Universal Data Insights worker deployment, run the following command: oc edit deployment udi-udiworker Add the following information to the host deployment HostAliases, in the spec.template.spec section: hostAliases: - hostnames: - qradar.iseccs.local ip: <1.2.3.4> For more information, see Adding entries to Pod /etc/hosts with HostAliases (https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).

   Copy the certificate details and paste it in the space that is provided.

7. Click Add a Configuration.
8. Configure identity and access.
   1. In the Configuration name field, enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
   2. In the Configuration description field, enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
   3. In the API Token field, enter the API token from the RHACS credentials.
   4. Click Add.
   5. To save your configuration and establish the connection, click Done.
9. To edit your configurations, complete the following steps:
   1. On the Assets tab, select the data source connection that you want to edit.
   2. In the Configurations section, click Edit Configuration ().
   3. Edit the identity and access parameters and click Save.