Connecting to a Cybereason asset data source

The Cybereason Connected Assets and Risk connector can be run in the platform cluster. The connector incrementally synchronizes the contents of the Cybereason asset databases with the data that is managed by the Connected Assets and Risk service.

1. Log in to IBM Security QRadar® Suite Software.
2. From the menu, click Connections > Data sources.
3. On the Integration data sources page, on the Cybereason tile, click Set up a connection.
4. On the Connection services page, select the Connected assets & risk service tile, and then click Enable.
   The available connection services include:

   1. Connected assets & risk
   2. Federated searches

   Note: If there are multiple data sources to connect, select the connector from the Sources list, and then click Enable.
5. Click Next.
6. On the Connection details page, configure the following parameters.
   1. Configure the connection to the data source.

      Table 1. Connection parameters

      Parameter	Description
      Data source name	Enter a unique name to identify the data source connection. You can create multiple connections to a data source, so it is useful to clearly set them apart by name. Only alphanumeric characters and the following special characters are allowed: - . _
      Data source description	Enter a description to indicate the purpose of the data source connection. You can create multiple connections to a data source, so it is useful to clearly indicate the purpose of each connection by description. Only alphanumeric characters and the following special characters are allowed: - . _
      Edge gateway	If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway field, specify an Edge Gateway to host the connector. It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
      Management IP address or Hostname	Specify the hostname or IP address (domain name) of the data source so that the IBM Security QRadar Suite Software can communicate with it.
      Host port	Enter the port number that is associated with the data source host. The port is 443 by default.
      Frequency	Select how often the connector imports data from the data source, in minutes. The value must be an integer. For example, a value of 5 causes the connector to run every 5 minutes. If the data source doesn't have many assets, or you don't want to import data often, reduce the frequency.
      Vulnerability Retention Period	Enter the number of days of vulnerabilities that you want to import. The default value is 30 days and the minimum value is 1 day.

   2. Click Next.
7. On the Connection configurations page, configure identity and access.
   1. Click Add a configuration.
   2. In the Configuration details window, configure the following parameters.

      Table 2. Configuration parameters

      Parameter	Description
      Configuration Name	Enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Configuration Description	Enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
      Username	Enter the username from Cybereason API credentials.
      Password	Enter the password from Cybereason API credentials.

   3. To save your configuration and establish the connection, click Save.
   4. Click Next.
8. Click Finish.
9. To manage your active connections, complete the following steps:
   1. On the Integration data sources page, on the tile of the relevant data source, click Manage <x> of <x> active connections.
   2. On the Connection status page, on the tile of the relevant data source, you can edit, refresh, or delete your data source connection.