Connecting to a QRadar asset data source

The IBM QRadar Connected Assets and Risk connector runs in the IBM Security QRadar Suite Software cluster. The connector incrementally synchronizes the contents of the QRadar asset databases with the data that is managed by the Connected Assets and Risk service.

Before you begin

Before you install the new connector, ensure that your QRadar version is 7.4.2 or later.

If you do not already have a Universal Data Insights data source connection for QRadar, add one before you complete this task. For more information, see Connecting to an IBM Security QRadar data source.
Important: The QRadar API token that you use to connect to QRadar must have the Admin role for both the Security Profile and User Role parameters. Configuring the Admin role ensures that the connector can access the QRadar API.

To support incremental data imports, your QRadar deployment must be 7.4.3 Fix Pack 5 or 7.5.0 Update Package 2 or later. Your IBM Security QRadar connector must be 3.1.4 or later. You can download connector updates from the IBM X-Force® Exchange / App Exchange (https://apps.xforce.ibmcloud.com/).

To access enriched asset data, including business context properties, custom properties, and User Behavior Analytics data, ensure that you are deploying QRadar Suite Software 1.9.0 or later. To access User Behavior Analytics data, install the User Behavior Analytics app 4.1.9 or later. Your QRadar deployment must be 7.4.3 Fix Pack 6 or later. The User Behavior Analytics app does not support incremental data imports.

About this task

Before you use the connector, you must investigate the optimization of the QRadar asset database. For more information, see Asset Management and Identification of asset growth deviations in the IBM QRadar documentation.
Important: The QRadar Connected Assets and Risk connection that you implement provides asset data from your QRadar instance. This data is based on the security profile that is associated with the QRadar API token.

To ensure the successful importing of QRadar asset data, the connector analyzes the asset data based on Connected Assets and Risk postgres database validation rules, and removes any invalid characters from the asset hostnames.

Restriction: If you use the IBM Security Edge Gateway to connect an IBM Security QRadar asset data source in 1.10.9 to 1.10.11, a configuration error is displayed.

Procedure

  1. Log in to IBM Security QRadar Suite Software.
  2. From the menu, click Connections > Data sources.
  3. On the Assets tab, click Connect an asset.
  4. Click IBM QRadar and QRadar On Cloud, then click Next.
  5. Configure the connection to allow IBM Security QRadar Suite Software to connect to the data source.
    1. In the Connector name field, assign a name to uniquely identify the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
    2. In the Connector description field, write a description to indicate the purpose of the data source connection.
      Tip: Only alphanumeric characters and the following special characters are allowed: - . _
    3. In the Edge gateway (optional) field, specify which IBM Security Edge Gateway to use.

      To use the Edge Gateway to host the containers that are required for communication between the data sources and IBM Security QRadar Suite Software, select an Edge Gateway. The Edge Gateway must be version 1.6 or later. It can take up to 5 minutes to establish the connection to the Edge Gateway.

      Important: If you have a firewall between your IBM Security QRadar Suite Software cluster and the data source target, use the Edge Gateway to host the containers.

      For more information, see Edge Gateway.

    4. In the Frequency field, set how often the connector imports data from the data source, in minutes. The default is 15 minutes.
      The value must be an integer.
      For example, a value of 5 causes the connector to run every 5 minutes.
      If the data source doesn't have many assets, or you don't want to import data often, reduce the frequency.
    5. In the Management IP address or Hostname field, set the hostname or IP address of the data source so that IBM Security QRadar Suite Software can communicate with it.
    6. In the Host Port field, set the port number that is associated with the data source host. The default port is 443.
    7. To access data from your User Behavior Analytics app, select the Enable Access to UBA API checkbox.
  6. Optional: If your QRadar deployment is configured with a privately signed Security Sockets Layer (SSL) certificate, add the connection certificate that you created when you configured the QRadar data source connection. For more information, see Determining whether your certificate is self-signed and Connecting to an IBM Security QRadar data source.
  7. Click Add a Configuration.
  8. Configure identity and access.
    1. In the Configuration name field, enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
    2. In the Configuration description field, enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
    3. In the Authentication Token field, paste the API token that you created when you configured the QRadar data source connection. The same authorized service token can be used for different connectors in IBM Security QRadar Suite Software. For more information, see Connecting to an IBM Security QRadar data source.
    4. Click Add.
    5. To save your configuration and establish the connection, click Done.
  9. Optional: Enable debug level logging. For more information, see Enabling debug level logging for a QRadar Connected Assets and Risk connector.
  10. To edit your configurations, complete the following steps:
    1. On the Assets tab, select the data source connection that you want to edit.
    2. In the Configurations section, click Edit Configuration (Edit configuration icon).
    3. Edit the identity and access parameters and click Save.

Results

The connector imports data from the data source. The connector imports data again at the interval that you set in the Frequency field.

You can see the data source connection configuration that you added under Connections on the Assets tab of the Data source settings page. A message on the card indicates connection with the data source.

When you add a data source, it might take a few minutes before the data source shows as being connected.
Tip: After you connect a data source, it might take up to 30 seconds to retrieve the data. Before the full data set is returned, the data source might display as unavailable. After the data is returned, the data source shows as being connected, and a polling mechanism occurs to validate the connection status. The connection status is valid for 60 seconds after every poll.

You can add other connection configurations for this data source that have different users and different data access permissions.

What to do next

Test the connection by searching for an IP address in IBM Security Data Explorer that matches an asset data source. In Data Explorer, click an IP address to view its associated assets and risk.

To use Data Explorer, you must have data sources that are connected so that the application can run queries and retrieve results across a unified set of data sources. The search results vary depending on the data that is contained in your configured data sources. For more information about how to build a query in Data Explorer, see Build a query.