February 2022 DSM Guide - IBM

1 IBM QRadarDSM Configuration GuideJune 2022 IBM NoteBefore using this information and the product that it supports, read the information in Notices onpage 1493. Copyright International Business Machines Corporation 2012, Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract withIBM this DSM Configuration xxxvPart 1. QRadar DSM installation and log source 1. Event collection from third-party 3 Adding a 2. Introduction to log source a log 5 Adding a log source by using the Log Sources 7 Adding bulk log 8 Adding bulk log sources by using the Log Sources bulk log 10 Editing bulk log sources by using the Log Sources a log source parsing 11 Testing log available for source 13 Creating a log source and removing log a log source 14 Chapter 3.

2 Gateway log source identifier 4. Log source 19 Examples of log source extensions on QRadar Support Forums .. 19 Patterns in log source extension 20 Match groups .. 20 Matcher (matcher).. 21 JSON matcher (json-matcher).. 26 LEEF matcher (leef-matcher).. 30 CEF matcher (cef-matcher).. 31 Name Value Pair matcher (namevaluepair-matcher).. 31 Generic List matcher (genericlist-matcher).. 33 XML Matcher (xml-matcher)..34 Multi-event modifier (event-match-multiple)..35 Single-event modifier (event-match-single).. 35 Extension document a log source extensions document to get data into regular expressions ..39 Building regular expression patterns.

3 40 Uploading extension documents to 42 Examples of parsing 5. Manage log source 47 Adding a log source 47 Chapter 6. Threat use cases by log source 49 iiiChapter 7. Troubleshooting 2. QRadar protocol 8. Undocumented an undocumented 67 Chapter 9. Protocol configuration 69 Akamai Kona REST API protocol configuration AWS S3 REST API protocol configuration 70 Amazon VPC Flow 76 Amazon VPC Flow Logs flow logs to an S3 the SQS queue that is used to receive ObjectCreated security credentials for your AWS user 80 Amazon Web Services protocol configuration Kafka protocol configuration 91 Configuring Apache Kafka to enable Client Apache Kafka to enable SASL Apache Kafka.

4 98 Blue Coat Web Security Service REST API protocol configuration Redrock REST API protocol configuration Firepower eStreamer protocol configuration 101 Cisco NSEL protocol configuration 102 EMC VMware protocol configuration 103 Forwarded protocol configuration cloud Pub/Sub protocol configuration Google cloud Pub/Sub to integrate with a Google cloud Pub/Sub log source in 107 Google G Suite Activity Reports REST API protocol G Suite Activity Reports REST API protocol BigFix SOAP protocol configuration options (formerly known as IBM BigFix).. 110 HTTP Receiver protocol configuration cloud Object Storage protocol configuration 112 IBM Fiberlink REST API protocol configuration 114 IBM Security Verify Event Service protocol configuration protocol configuration - SiteProtector protocol configuration Networks NSM protocol configuration Security Binary Log Collector protocol configuration 125 Log File protocol configuration 125 Microsoft Azure Event Hubs protocol configuration 127 Configuring Microsoft Azure Event Hubs to communicate with Microsoft Azure Event Hubs Defender for Endpoint SIEM REST API protocol configuration DHCP protocol configuration

5 Exchange protocol configuration Graph Security API protocol configuration 148 Configuring Microsoft Graph Security API to communicate with 149 Microsoft IIS protocol configuration 150 Microsoft Security Event Log protocol configuration 153 Microsoft Security Event Log over MSRPC 153MQ protocol configuration 156 Office 365 Message Trace REST API protocol configuration the Office 365 Message Trace REST API 159 Okta REST API protocol configuration 162iv OPSEC/LEA protocol configuration Database Listener protocol configuration 164 PCAP Syslog Combination protocol configuration 166 SDEE protocol configuration Protection REST API protocol configuration Protection REST API protocol Tail protocol configuration protocol configuration protocol configuration Enterprise Console JDBC protocol configuration 177 Sourcefire Defense Center eStreamer protocol Redirect protocol 179 TCP multiline syslog protocol configuration Syslog protocol configuration 186 Multiple log sources over TLS multiline syslog protocol configuration vCloud Director protocol configuration 195 Chapter 10.

6 Universal cloud REST API 200 Workflow Parameter 209 Create 213If/ operations in JSON in JPath line testing 11. Protocols that support Certificate 229 vPart 3. 12. 3 Com Switch your 3 COM Switch 8800 ..234 Chapter 13. AhnLab Policy 235 Chapter 14. Akamai an Akamai Kona log source by using the HTTP Receiver an Akamai Kona log source by using the Akamai Kona REST API Akamai Kona to communicate with 240 Creating an event map for Akamai Kona 240 Modifying the event map for Akamai Kona sample event 242 Chapter 15. Amazon AWS Application Load Balancer Access AWS Application Load Balancer Access Logs DSM 245 Publishing flow logs to an S3 an SQS queue and configure S3 ObjectCreated the S3 bucket that contains the data that you want to the SQS queue that is used to receive ObjectCreated up SQS queue ObjectCreated security credentials for your AWS user AWS S3 REST API log source parameters for Amazon AWS Application Load BalancerAccess AWS Application Load Balancer Access Logs sample event 16.

7 Amazon AWS an Amazon AWS CloudTrail log source by using the Amazon AWS S3 REST 258 Configuring an Amazon AWS CloudTrail log source that uses an S3 bucket with an 258 Configuring an Amazon AWS CloudTrail log source that uses an S3 bucket with a 270 Configuring an Amazon AWS CloudTrail log source by using the Amazon Web Services protocol. 276 Configuring an Amazon AWS CloudTrail log source by using the Amazon Web Servicesprotocol and Kinesis Data an Amazon AWS CloudTrail log source by using the Amazon Web Servicesprotocol and CloudWatch 282 Amazon AWS CloudTrail sample event 287 Chapter 17. Amazon AWS Elastic Kubernetes AWS Elastic Kubernetes Service DSM 289 Configuring Amazon Elastic Kubernetes Service to communicate with security credentials for your AWS user Web Services log source parameters for Amazon AWS Elastic Kubernetes AWS Elastic Kubernetes Service sample event 294 Chapter 18.

8 Amazon AWS Network AWS Network Firewall DSM 297 Create an SQS queue and configure S3 ObjectCreated the S3 bucket that contains the data that you want to the SQS queue that is used to receive ObjectCreated up SQS queue ObjectCreated Configuring security credentials for your AWS user AWS S3 REST API log source parameters for Amazon AWS Network Network Firewall sample event 306 Chapter 19. Amazon AWS Route AWS Route 53 DSM 309 Configuring an Amazon AWS Route 53 log source by using the Amazon Web Services protocoland CloudWatch 310 Configuring public DNS query Resolver query an Identity and Access Management (IAM)

9 User in the AWS Management 312 Configuring security credentials for your AWS user 312 Creating a log group in Amazon CloudWatch Logs to retrieve logs in Web Services log source parameters for Amazon AWS Route 313 Configuring an Amazon AWS Route 53 log source by using an S3 bucket with an SQS 318 Configuring Resolver query an SQS queue and configure S3 ObjectCreated 319 Finding the S3 bucket that contains the data that you want to the SQS queue that is used to receive ObjectCreated up SQS queue ObjectCreated an Identity and Access Management (IAM) user in the AWS Management 326 Configuring security credentials for your AWS user 327 Amazon AWS S3 REST API log source parameters for Amazon AWS Route 53 when usingan SQS 327 Configuring an Amazon AWS Route 53 log source by using an S3 bucket with a directory 331 Configuring Resolver query an S3 bucket name and directory 332 Creating an Identity and Access Management (IAM) user in the AWS Management 332 Configuring security credentials for your AWS user 333 Amazon AWS S3 REST API log source parameters for Amazon AWS Route 53 when using adirectory 333 Amazon AWS Route 53 sample event 20.

10 Amazon AWS Security 339 Creating an EventBridge rule for sending an Identity and Access (IAM) user in the AWS Management 343 Amazon AWS Security Hub DSM 343 Amazon AWS Security Hub Sample event 343 Chapter 21. Amazon AWS AWS WAF DSM Amazon AWS WAF to communicate with 346 Configuring security credentials for your AWS user AWS S3 REST API log source parameters for Amazon AWS AWS WAF sample event 348 Chapter 22. Amazon 351 Configuring an Amazon GuardDuty log source by using the Amazon Web Services 351 Creating an EventBridge rule for sending an Identity and Access (IAM) user in the AWS Management 355 Configuring an Amazon GuardDuty log source by using the Amazon AWS S3 REST API Amazon GuardDuty to forward events to an AWS S3 358 Amazon GuardDuty sample event 23.