Configuring IBM i to integrate with IBM QRadar

You can integrate IBM® i with IBM QRadar®.

1. From IBM Fix Central (http://www.ibm.com/support/fixcentral), download the following file:

   AJLIB.SAVF

2. Copy the AJLIB.SAVF file to a computer or terminal that has FTP access to IBM i.
3. Create a generic online SAVF file on the IBM i by typing the following command:

   CRTSAVF QGPL/SAVF

4. Use FTP on the computer or terminal to replace the IBM i generic SAVF file with the AJLIB.SAVF file that you downloaded.

   Type the following commands:

   bin

   cd qgpl

   lcd c:\

   put ajlib.savf AJLIB

   quit

   If you are transferring your SAVF file from another IBM i system, send the file by placing the FTP sub-command mode BINARY before the GET or PUT statement.
5. Restore the AJLIB file on IBM i by typing the following command:

   RSTLIB SAVLIB(AJLIB) DEV(*SAVF) SAVF(QGPL/AJLIB)

   AJLIB provides the mapping and data transfer support that is needed to send IBM i audit journal entries to QRadar.

6. Run AJLIB/SETUP

   The setup screen is used to configure AJLIB for FTP, SFTP, or a local path to receive the processed entries.

   The server user ID is required for FTP or SFTP, and a password is required for FTP. While FTP handles line delimiter conversions, you set the line feed to the expected value for the type of system that receives the SFTP transfers.

7. If you want to use SFTP, run AJLIB/GENKEY.

   This command generates the SSH key pair that is required for SFTP authentication. If the key pair exists, it is not replaced. If you want to generate a new key pair, before you run this command, remove the existing key files from the /ajlib/.ssh directory.

   For more information about SSH key pair configuration on the IBM i , see http://www-01.ibm.com/support/docview.wss?uid=nas8N1012710

8. After you generate a key pair, use the following steps to enable the use of the key pair on the server:
   1. Copy the id_rsa.pub file from the /ajlib directory to the SSH server, and then install it in the appropriate folder.
   2. Ensure that the SSH server is added to the known_hosts file of the user profile that runs the AJLIB/AUDITJRN command.
9. Use the appropriate user profile to do the following steps:
   1. Start a PASE (Portable Application Solutions Environment) shell by typing the following command:

      call qp2term

   2. Start a session with the SSH server by typing the following command:

      ssh -T <user>@<serveraddress>

   3. If prompted, accept the system key, and enter a password.
   4. Type exit, to close the SSH session.
   If you want to run these steps under a different IBM i profile than the one that runs the AJLIB/AUDITRN command, copy the .ssh directory and known_hosts file to the home directory of the profile that is used to run this command.
10. To configure the filtering of specific entry types, use the AJLIB/SETENTTYP command.
11. Set up the data collection start date and time for the audit journal library (AJLIB) by typing the following command:

    AJLIB/DATETIME

    If you start the audit journal collector, a failure message is sent to QSYSOPR.

    The setup function sets a default start date and time for data collection from the audit journal to 08:00:00 of the current day.

    To preserve your previous start date and time information from a previous installation, you must run AJLIB/DATETIME. Record the previous start date and time and type those values when you run AJLIB/SETUP. The start date and time must contain a valid date and time in the six character system date and system time format. The end date and time must be a valid date and time or left blank.

12. Run AJLIB/AUDITJRN.

    The audit journal collection program starts and sends the records to your remote FTP server: If the transfer to the FTP server fails, a message is sent to QSYSOPR. The process for starting AJLIB/AUDITJRN is typically automated by an IBM i job Scheduler, which collects records periodically.

    If the FTP transfer is successful, the current date and time information is written into the start time for AJLIB/DATETIME to update the gather time, and the end time is set to blank. If the FTP transfer fails, the export file is erased and no updates are made to the gather date or time.