Creating a Riverbed SteelCentral NetProfiler report template and generating an audit file

To prepare for Riverbed SteelCentral NetProfiler integration with QRadar, create a report template on the Riverbed SteelCentral NetProfiler and then use a third-party host to generate an audit file. The third-party host must be a system other than the host you use for Riverbed SteelCentral NetProfiler or QRadar.

Before you begin

Ensure that the following items are installed on a third-party host that you use to run the audit report:
Python
Download and install Python from the Python website (https://www.python.org/download/).
SteelScript for Python
Download and install the SteelScript for Python SDK from the Riverbed SteelScript for Python website (https://support.riverbed.com/apis/steelscript/index.html). The script generates and downloads an audit file in CSV format. You must periodically run this script.

Procedure

  1. Define the audit file report template.
    1. Log in to your Riverbed SteelCentral NetProfiler host user interface.
    2. Select System > Audit Trail.
    3. Select the criteria that you want to include in the audit file.
    4. Select a time frame.
    5. On the right side of the window, click Template.
    6. Select Save As/Schedule.
    7. Type a name for the report template.
  2. To run the report template and generate an audit file, complete the following steps
    1. Log in to the third-party host on which you installed Python.
    2. Type the following command: 
      $ python ./get_template_as_csv.py  <riverbed_host_name>  -u admin -p admin -t "<report_template_name>"  -o <absolute_path_to_target file>
      Tip: Record the report template name and file path. You need to use the name to run the report template and when you configure a log source in the QRadarinterface.