Question & Answer
Question
This technical note answers frequently asked questions and provides information related to geographic data that the QRadar® Support commonly answers.
Answer
1. About geographic data in QRadar
Geographic data (geodata) in QRadar is used to associate an IP address from the user interface to display a visual flag indicator or map overview to users. Geodata makes the source or destination for the IP address associated to an event, flow, or offense more easily understood than just displaying an IP address. Geographic data allows administrators to not only show the location of a host related to an event, flow, or offense, but to also define the location of your network assets. Geographic data also allows users to create searches or rules when events or flows occur outside or within a geographic range. For example, create an offense when an authentication occurs from an unusual location or more than 50 miles from an office location.
Where is geographic data used in QRadar?
- IP address hover menus in the user interface
- Flag icons to designate the country or region of an IP address
- Searches
- Rules
- Reports
- Advanced search (GEO::LOOKUP or GEO::DISTANCE)
2. Configuring a MaxMind account for geographic data updates
Important: If you are a QRadar on Cloud administrator, you must provide your User ID and License Key information in a QRadar Support case. The DevOps team for your QRadar on Cloud Console can enable geographic data for your deployment.
- Create a free MaxMind account: https://www.maxmind.com/en/geolite2/signup
- After your account is created, an email is provided by MaxMind.
- Create a password for your account.
- After you assign an account password, use the credentials you created to sign in.
- Click Manage License Keys.
- Click Generate new license key.
- Configure the following values:
- In the License key description, type: QRadar License Key.
- In the field, 'Will this key be used for GeoIP Update', select Yes.
- For QRadar 7.5.0 UP4 or newer versions, select Generate a license key and config file for geoipupdate versions 3.1.1 or newer.
- For QRadar 7.5.0 UP3 or older versions, Maxmind no longer issuing license key for geoipupdate version 3.1.0 or older since 2023 March 27th. The newer license format can be used however you will need to verify the installed version of the rpm.
SSH to your QRadar Console and run the command :
If the result doesn't return version geoipupdate-3.1.1-1.noarch.rpm or newer, open a case with QRadar Support with the subject: Qradar 7.5.0 UP 3 or before -- config update: request for geoipupdate-3.1.1-1.noarch.rpmrpm - qa | grep geoipupdate
- Click Confirm.
- Record the Account and User ID and License Key information.
Important: If you exit the license key screen without recording the information, you must generate a new license key from Step 4.
- Log in to QRadar as an administrator.
- Click the Admin tab.
- Click the System Settings icon.
- Navigate to Geographic Settings.
- Update the User ID and License Key values from Step 5.
- Click Save.
- From the Admin tab, click Deploy Changes.
Results
After the deploy changes is complete, geographic data settings are updated for the QRadar deployment. Administrators can confirm their MaxMind geographic settings from the command line of the QRadar Console.
3. How to verify your geographic data updates
Administrators can verify geographic data (geodata) updates from the QRadar command-line interface. After you update your System Settings to use your MaxMind User ID and License, you can attempt to run an update, and verify whether any errors occur. To complete this procedure, you must have root access to QRadar.
- Use SSH to log in to your QRadar Console as the root user.
- To update geographic data, type:
/opt/qradar/bin/geodata_update.sh
Results
- If successful, the administrator is returned to the command prompt with no errors displayed on screen.
- If unsuccessful, a 401 Unauthorized error is displayed. If you experience an error, confirm the credentials in the QRadar System Settings from Step 10, then click Save and Deploy Changes. Repeat the verification procedure or generate a new license key from the MaxMind website. If you continue to experience problems or believe that the Deploy Changes does not complete successfully, open a case with QRadar Support.
4. Setting up geodata in QRadar
In QRadar version 7.3.3 or newer version, the API call to MaxMind® for daily updates occurs at 4:30 AM. Administrators who want a more guaranteed resolution for IP addresses can configure their own data feeds to get updates from external servers. Either option that administrators choose requires that the Console has an Internet connection and that a proxy is configured in QRadar for connections to external data sources.
What to configure
- Verify that your proxy is configured for QRadar Auto Updates.
1a. Click Admin tab > Auto Updates > Change Settings > Advanced.
1b. Most enterprise networks require a proxy to connect to external IP addresses. If you want to download free or paid geographic database updates, administrators need to configure a proxy address. - Verify that the Geographic Setting is configured to use the defined proxy.
2a. Click Admin tab > System Settings > Geographic Settings > Use Proxy Settings Defined in Auto Update = True.
2b. Attempts to access external data feeds might not succeed when a proxy is required and the field is set to False. - Confirm your Geographic Settings to verify whether you want to use the Registered Location or Physical Location for flag information in QRadar.
3a. Click Admin tab > System Settings > Geographic Settings > Country Selection.
3b. Administrators need to define whether the flag and country information from the geographic data uses the registered or the physical location from the downloaded database. Registered locations can be different from the actual physical location of the server and by using the registered location can lead to the wrong flags and search results or rules get triggered unintentionally. The default value for resolving IP addresses in QRadar is Registered location. - Optional. To have private IP addresses ranges show country and map mouse hover information, you must configure the Network Hierarchy in QRadar to include country for flag, latitude, and longitude for the map information.
5. Communication issues
A good test to verify that you can retrieve geographic data updates is to attempt to download the MaxMind® GeoLite2-City db to the QRadar Console. If you can download the file from their site to the Console, it verifies that you can connect to the API get updates in QRadar.
- Using SSH, log in to the QRadar Console as the root user.
- Navigate to a temporary directory, such as /storetmp.
- To test internet connectivity, type the following command to download the GeoLite2-City database file:
Note: The {your_license_key} value is displayed to users on the Maxmind portal when you generate your geographic data license. To confirm your license key, you might be required to access your Maxmind account or contact the owner of your license in your corporation. The license key value cannot be retrieved from the QRadar System Settings as this value is obfuscated for security purposes.wget "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-City&license_key={your_license_key}&suffix=tar.gz"
Results
A. If successful, the file is downloaded to the temporary directory. This file can be removed from QRadar as the test is complete.
B. If unsuccessful, verify the proxy settings in the Auto Update configuration of QRadar. Alternately, the administrator can review the proxy settings to ensure that a firewall is not blocking connections to maxmind.com for QRadar updates.
6. Incorrect geodata references
The MaxMind® data GeoLite2-City used within QRadar is not guaranteed to be as accurate as paid geographic data versions. Administrators who require accurate updates of geographic data within QRadar can use a premium feed to ensure that the data accuracy is guaranteed to the precision level requirements of your organization. Geographic data updates to the Geo2lite database provided by MaxMind® are updated monthly.
Note: Currently only GeoLite2-City and GeoIP2-City databases are supported.
- Verify that you have the latest geographic data updates by running ./opt/qradar/bin/geodata_update.sh from the QRadar Console.
- Confirm the IP address online against the MaxMind® geographic lookup demonstration page to determine whether the incorrect reference is also contained within the premium GeoIP® precision city data that can be licensed by administrators from MaxMind.
- If you are using the free feed that is default in QRadar, you can download and to verify whether the Geolite2 CSV data includes an incorrect reference. IP address for CIDR ranges can be found in GeoLite2-Country-Blocks file for your IP addresses. The corresponding country codes can be referenced in the GeoLite2-Country-Locations file to confirm if the incorrect reference is included in the free Geolite2 data.
- Users with free geographic data feeds ought to know that changes to geographic updates are monthly. QRadar is not in control of when new geographic data versions are posted. A cron utility runs at 4:30 AM on the QRadar Console to update geographic data from the MaxMind® API.
- If the incorrect data is for an IP address in a network controlled by your organization, you can update your Network Hierarchy to include Country and Latitude and Longitude information. Updates to the Network Hierarchy override the geographic data provided by the feed and use the country and coordinates provided by the administrator.
7. Can the flag and map mouse hover be disabled in the user interface?
You can disable the flag mouse hover, for maps in System Settings by changing the 'Country/Region Flags' setting or the 'Embedded Maps in IP Address Tooltips' setting to No. The default value in QRadar is to set the Country/Flag value to Yes (enabled). The region flags and embedded maps for IP address settings are global to QRadar, meaning that this configuration is set for all users. Currently, there is no method to selectively enable or disable country/region flags for certain users.
- To disable country/region flags, change the global system setting in QRadar.
Click Admin tab > System Settings > Display Country/Region Flags.
Yes= Enable country/region flags for all users (Default).
No = Disable country/region flags for all users.
- To disable map mouse hovers for IP addresses in the user interface.
Click Admin tab> System Settings > Display Embedded Maps in IP Address Tooltips.
Yes= Enable map over for IP addresses for all users (Default).
No = Disable map over for IP addresses for all users.
8. About Network Hierarchy
Administrators who are setting up QRadar for the first time ought to be aware that geographic data is not a requirement when you configure the Network Hierarchy in QRadar. It is possible for administrators to define a country, latitude, and longitude for your networks. If you decide to input either country, latitude, and longitude information in to your Network Hierarchy, you need to maintain it when you make network changes or reallocate addresses within your networks if that ever occurs. The Network Hierarchy in QRadar is used to define your networks by CIDR address and allows you to logically divide data coming in from outside networks (remote) to internal assets you are responsible for (local). When you define your Network Hierarchy, you are instructing QRadar how to apply metadata to your events and flows so we understand what is L2R, R2L, or L2L information.
- L2R - Local-to-remote indicates that is a communication between a network asset and an external server.
- R2L - Remote-to-local indicates a communication from an external server/network to an internal asset that is within your network hierarchy.
- L2L - Local-to-local indicates a communication between two assets within your network hierarchy.
- R2R - Remote-to-remote. R2R connections in QRadar, is an indicator that you have a network hierarchy issue or need to make a network hierarchy update. One of the server IP addresses from the event or flow is supposed to belong to your network hierarchy.
What do I need to review related to geographic data?
If you are a QRadar administrator or user, you ought work with your organization to review the existing Network Hierarchy and determine update policies on Country, Latitude, and Longitude information. As the administrator you have the option to add overrides to the existing Network Hierarchy in QRadar, but these might require maintenance on your part to keep up with network changes. Users that create overrides for geolocation data in QRadar might create issues with the accuracy of the Network Hierarchy. Scheduling regular reviews helps to maintain geodata and Network Hierarchy accuracy.
Do I need to configure country or coordinates for all my addresses in the Network Hierarchy?
The Network Hierarchy configuration is configured to accommodate most default networks. To improve accuracy or location of coordinates for a specific public IP address, you might need to update the Network Hierarchy IP addresses to ensure the data is more representative of the needs of your organization. If your organization makes use of geographic information for private IP address ranges, you can consider adding country, latitude, and longitude information in to the Network Hierarchy for your nonroutable IP addresses. Adding geographic data for latitude and longitude in the QRadar Network Hierarchy for your private IP addresses, allows advanced searches for your private IP address ranges (GEO::LOOKUP or GEO::DISTANCE) and provides extra rule capability to administrators.
Overriding default geographic feed data in Network Hierarchy
IP addresses display a flag and a geographic over in the user interface for all public IP address ranges, unless disabled in QRadar. Administrators have the option to select a country/region for their latitude and longitude coordinates for their internal networks from the Network Hierarchy interface in the Admin tab. When country, latitude, and longitude information are added manually for a CIDR range by an administrator, the information from the Network Hierarchy is used as an override to define where that network exists geographically. Administrators are expected to maintain their geographic data in Network Hierarchy as it might require maintenance as networks change over time. If the administrator configures a country for a specific CIDR range in the Network Hierarchy, this information overrides the default geographic data. Each time you update values in your Network Hierarchy with country or coordinate data, the information provided is used for those IP addresses within the CIDR range for both flag icons and IP address coordinates. Country or coordinate data can be added in the Network Hierarchy for both public and private (non-routable) addresses. In earlier versions of QRadar®, nonrouteable IP address ranges would not appear with a specific country flag or region, since they are not within a public IP address range. If the administrator wants private IP address ranges to display on flags, you need to be using QRadar V7.3.1, or later to have country and coordinates entered in CIDR ranges that contain your private IP addresses.
Related Information
Was this topic helpful?
Document Information
Modified date:
05 April 2024
UID
ibm10736025