Riverbed SteelCentral NetProfiler (Cascade Profiler) Alert

The IBM QRadar DSM for Riverbed SteelCentral NetProfiler collects alert logs from your Riverbed SteelCentral NetProfiler system. This product is also known as Cascade Profiler.

The following table identifies the specifications for the Riverbed SteelCentral NetProfiler DSM:
Table 1. Riverbed SteelCentral NetProfiler specifications
Specification Value
Manufacturer Riverbed
DSM name SteelCentral NetProfiler
RPM file name DSM-RiverbedSteelCentralNetProfiler-QRadar_version-build_number.noarch.rpm
Protocol JDBC
Recorded event types Alert Events
Automatically discovered? No
Includes identity? No
Includes custom properties? No
More information Riverbed website (http://www.riverbed.com/)
To integrate Riverbed SteelCentral NetProfiler with QRadar, complete the following steps:
  1. If automatic updates are not enabled, download and install the most recent versions of the following RPMs from the IBM® Support Website onto your QRadar Console.
    • Protocol-JDBC RPM
    • Riverbed SteelCentral NetProfiler RPM
  2. Configure your Riverbed SteelCentral NetProfiler system to enable communication with QRadar.
  3. Create a log source on the QRadar Console. Use the following table to define the Riverbed-specific JDBC parameters:
    Table 2. Riverbed SteelCentral NetProfiler JDBC log source parameters
    Parameter Description
    Log Source Type Riverbed SteelCentral NetProfiler
    Protocol Configuration JDBC
    Log Source Identifier

    Type a name for the log source. The name can't contain spaces and must be unique among all log sources of the log source type that is configured to use the JDBC protocol.

    If the log source collects events from a single appliance that has a static IP address or host name, use the IP address or host name of the appliance as all or part of the Log Source Identifier value; for example, 192.168.1.1 or JDBC192.168.1.1. If the log source doesn't collect events from a single appliance that has a static IP address or host name, you can use any unique name for the Log Source Identifier value; for example, JDBC1, JDBC2.
    Database Type Postgres
    Database Name You can type the actual name of the Riverbed database. For most configurations, the database name is mazu.
    Tip: Confirm the actual name of the Riverbed database.
    IP or Hostname The IP address or host name of the database server.
    Port

    Enter the JDBC port. The JDBC port must match the listener port that is configured on the remote database. The database must permit incoming TCP connections. The valid range is 1 - 65535.

    The defaults are:

    • MSDE - 1433
    • Postgres - 5432
    • MySQL - 3306
    • Sybase - 1521
    • Oracle - 1521
    • Informix® - 9088
    • DB2® - 50000

    If a database instance is used with the MSDE database type, you must leave the Port field blank.
    Table Name events.export_csv_view
    Select List The list of fields to include when the table is polled for events. You can use a comma-separated list or type an asterisk (*) to select all fields from the table or view. If a comma-separated list is defined, the list must contain the field that is defined in the Compare Field.
    Username The user name for the account that is configured to access the PostgreSQL database on the Riverbed SteelCentral NetProfiler system.
    Password The password that is required to connect to the database.
    Compare Field start_time
    Use Prepared Statements Prepared statements enable the JDBC protocol source to set up the SQL statement, and then run the SQL statement numerous times with different parameters. For security and performance reasons, most JDBC protocol configurations can use prepared statements.
    Start Date and Time (Optional)

    Type the start date and time for database polling in the following format: yyyy-MM-dd HH:mm with HH specified by using a 24-hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.
    Polling Interval 5M
    EPS Throttle

    The maximum number of events per second that QRadar ingests.

    If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle.

    The valid range is 100 to 20,000.

For more information about configuring JDBC protocol parameters, see c_logsource_JDBCprotocol.html