You must create an authorized service token to authenticate the background services that
the app uses to request data from your local instance of IBM®
QRadar®.
About this task
You must create an authorized service token for the Cyber Adversary Framework Mapping Application
to get the latest Cyber Adversary Framework Mapping Application content.
Note: The QRadar Advisor with Watson app
automatically maps MITRE ATT&CK tactics to CRE rules. With the Cyber Adversary Framework Mapping
Application, you can map your custom rules to specific tactics.
-
On the
navigation menu (
), click
Admin.
-
In QRadar 7.3.3 or
later, click .
-
Click the Settings icon.
-
On the Authorization Token tab, click the Manage Authorized
Services link.
-
On the Manage Authorized Services window, click Add Authorized
Service.
-
Add the relevant information in the following fields and click Create
Service.
-
In the Service Name field, type a name for this authorized service. The
name can be up to 255 characters in length.
-
From the User Role list, select the appropriate role for the user
type.
-
From the Security Profile list, select the security profile that you
want to assign to this authorized service. The security profile determines the networks and log
sources that this service can access on the QRadar user interface.
-
In the Expiry Date list, type or select a date that you want this
service to expire. If an expiry date is not necessary, select No
Expiry.
-
Click the row that contains the service you created, select and copy the token string from the
Selected Token field in the menu bar, and close the Manage
Authorized Services window.
-
Paste the Admin token string into the Admin Token field.
-
Click Save Token.
-
If you have a proxy, click the Proxy settings tab, select the
Use proxy checkbox.
-
Select the type of secure protocol you want to use for your proxy:
-
If your proxy server does not require a username and password, select the Disable
Authentication checkbox.
- In the Proxy server field, type the URL for the proxy server. The
proxy server is required if the application server uses a proxy server to connect to the
internet.
- In the Proxy port field, type the port number for the proxy server.
- In the Proxy username field, type the username for the proxy server.
A username is required if you are using an authenticated proxy.
- In the Proxy password field, type the password for the proxy server.
A password is required if you are using an authenticated proxy.
-
If you have a custom SSL certificate for proxy communication between your QRadar instance and the X-Force®
Exchange, select the
Enable Custom SSL Certificate Validation checkbox.
-
Click the file upload icon
and select your custom SSL certificate. Only .pem files are supported.
-
Click Save Configuration.