Connecting to a QRadar asset data source

The IBM QRadar Connected Assets and Risk connector runs in the IBM Security QRadar Suite Software cluster. The connector incrementally synchronizes the contents of the QRadar asset databases with the data that is managed by the Connected Assets and Risk service.

1. Log in to IBM Security QRadar Suite Software.
2. From the menu, click Connections > Data sources.
3. On the Assets tab, click Connect an asset.
4. Click IBM QRadar and QRadar On Cloud, then click Next.
5. Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
   1. In the Connector name field, assign a name to uniquely identify the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
   2. In the Connector description field, write a description to indicate the purpose of the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
   3. In the Edge gateway (optional) field, specify which IBM Security Edge Gateway to use.

      To use the Edge Gateway to host the containers that are required for communication between the data sources and IBM Security QRadar Suite Software, select an Edge Gateway. The Edge Gateway must be version 1.6 or later. It can take up to 5 minutes to establish the connection to the Edge Gateway.

      Important: If you have a firewall between your IBM Security QRadar Suite Software cluster and the data source target, use the Edge Gateway to host the containers.

      For more information, see Edge Gateway.

   4. In the Frequency field, set how often the connector imports data from the data source, in minutes. The default is 15 minutes.
      The value must be an integer.
      For example, a value of 5 causes the connector to run every 5 minutes.
      If the data source doesn't have many assets, or you don't want to import data often, reduce the frequency.
   5. In the Management IP address or Hostname field, set the hostname or IP address of the data source so that IBM Security QRadar Suite Software can communicate with it.
   6. In the Host Port field, set the port number that is associated with the data source host. The default port is 443.
   7. To access data from your User Behavior Analytics app, select the Enable Access to UBA API checkbox.
6. Optional: If your QRadar deployment is configured with a privately signed Security Sockets Layer (SSL) certificate, add the connection certificate that you created when you configured the QRadar data source connection. For more information, see Determining whether your certificate is self-signed and Connecting to an IBM Security QRadar data source.
   If the value of your hostname or IP address does not match the common name value in your certificate, add the hostname to the server that hosts the Edge Gateway.

   Table 1. Adding your hostname to the Edge Gateway server

   If you are running the Edge client

   If you are not running the Edge client

   Run the following command: manageAppHost dns --set --ip <ip_address> --hostname <hostname1> --hostname <hostname2> Tip: The <ip_address> is the address of the server that you want to access, and <hostname> is the name of the server. If a server has multiple names, you can add each name by using --hostname. You can use --show to see the defined hostnames and --clear to remove a hostname previously set with the manageAppHost command.

   Add the hostname to the server that hosts the Edge Gateway by adding entries to Pod /etc/hosts with HostAliases. To edit the Universal Data Insights worker deployment, run the following command: oc edit deployment udi-udiworker Add the following information to the host deployment HostAliases, in the spec.template.spec section: hostAliases: - hostnames: - qradar.iseccs.local ip: <1.2.3.4> For more information, see Adding entries to Pod /etc/hosts with HostAliases (https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/).

   Copy the certificate details and paste it in the space that is provided.

7. Click Add a Configuration.
   1. Configure identity and access.

      Table 2. Configuration parameters

      Parameter	Description
      Configuration Name	Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description	Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Authorized Services Token	Enter the unique identifier of the data source that you want to establish the connection with. The same authorized service token can be used for different connectors in the platform. To obtain an authorized service token: Open the Admin tab on the QRadar Console. Go to Authorized Services. Select Add new Authorized Service. Create a user role. The user role must have Event and Flow viewing permissions; specifically, Log Activity and Network Activity. If you want to use the same authentication token when you configure the QRadar Connected Assets and Risk connector, the token must also have the Assets permission. Copy and paste the authentication token after it is created. Deploy QRadar.

   2. Click Add.
   3. To save your configuration and establish the connection, click Done.
8. To edit your configurations, complete the following steps:
   1. On the Assets tab, select the data source connection that you want to edit.
   2. In the Configurations section, click Edit Configuration ().
   3. Edit the identity and access parameters and click Save.