IBM QRadar log source extension to parse your cluster audit logs

You can map your product audit events to IBM QRadar event model by using the DSM (Device Support Module) editor.

Log source type is used to parse audit logs. You can add custom properties to parse custom fields. For a list of custom properties, see Custom properties to parse your cluster audit records.

Note: If you already set up log source type, you do not need to complete the tasks that are in the following sections. You can proceed with Configuring IBM QRadar to receive your cluster audit logs over TLS.

Create log source type

1. Navigate to DSM Editor Admin > Data Sources > DSM Editor.

2. Click Create New to create a new log source type.

3. Enter a name for the new log source type and save it.

Add custom properties to log source type

1. Use the following audit record sample your product to extract fields and add custom properties.

IBM QRadar

{"typeURI":"http://schemas.dmtf.org/cloud/audit/1.0/event","eventType":"activity","id":"icp:db4217b0-f274-11e8-a8f9-51a9a7260dca","action":"create","requestPath":"/identity/api/v1/directory/ldap/ddd46230-e77a-11e8-92af-2773a9077558/importUserGroups","initiator":{"typeURI":"service/security/account/user","name":"admin","credential":{"type":"token"},"host":{"user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15","address":"icp-management-ingress:8443"}},"target":{"id":"07035ecfb9a2aeab68826ae643f4352a8e016e0c89c17185b61e78e7d4574235","name":"ddd46230-e77a-11e8-92af-2773a9077558","actions":"cn=testgroup,ou=groups,dc=ibm,dc=com","typeURI":"service/storage/directory"},"observer":{"id":"target"},"severity":"normal","outcome":"success","reason":{"reasonType":"HTTP","reasonCode":200},"eventTime":"2018-11-27T18:47:14.347Z","kubernetes.container_id":"07035ecfb9a2aeab68826ae643f4352a8e016e0c89c17185b61e78e7d4574235","kubernetes.container_name":"platform-identity-management","kubernetes.pod":"auth-idp-zxqbm","kubernetes.namespace":"kube-system","origination":"ui","version":"v1.0"}

1. Click the edit icon.

2. Paste your product audit record sample in the workspace and save it.

3. Click Add to add custom properties.

4. If a property was not created previously, click Create New.

5. Enter the name of the property and select the appropriate field type. Add a brief description and save it.

6. Select all required properties and add them to Log Source Type.

Configure properties

Your product audit records are in JSON format. Properties can use Expression Type as JSON.

Edit property configuration

1. Select a property that needs to be configured, for example, Pod Name.
2. Select the JSON Expression Type from the list.
3. Specify the JSON expression.
4. Keep Enabled selected.
5. Add multiple expressions if necessary.

Custom properties to parse your product audit records

Keep the following properties as is.