IBM QRadar Integration

Integration of XDR Forensics with IBM QRadar is possible via a feature called “Custom Actions”.

When QRadar generates an alert for an incident, it runs a script provided in Custom Actions,
The properties of the alert alongside some fixed properties are then sent to the trigger URL provided in the bash script,
Upon receiving the URL request, XDR Forensics extracts the IP address or Hostname from the URL and automatically assigns an acquisition task to the endpoint in question. The acquisition profile that will be used for this task is provided when you create a trigger.

Steps to Integrate

Step 1: Create a Script File

Create a script file with the contents below and save it as “air-trigger.sh”

#!/bin/bash

# Define external variables
air_address=$1
trigger_name=$2
trigger_token=$3
endpoint=$4

# Make a GET request to XDR Forensics console API
output=$(curl -k http://$air_address/api/webhook/$trigger_name/$endpoint?token=$trigger_token)

# Print out the output
echo $output

Step 2: Create a Trigger for QRadar

Visit the Triggers page in XDR Forensics
Click the ”+ New Trigger” button on the upper right corner
Provide a self-explanatory name (examples: RDP Brute Force Trigger, Phishing Detected Trigger, and etc.)
Select “QRadar Read Endpoint Name or IP Address from URL Path” as the parser for this trigger
Select an Acquisition Profile that will be used when this trigger is activated by QRadar
Select the Ignore option or leave it with its default value (defaults to 24 hours for recurrent alerts for a single endpoint)
Provide other settings such as Compression, Encryption, Evidence Repository to use or let XDR Forensics configure them automatically based on the matching policy
Click the “Save” button
Hover your mouse over the link below the Trigger name and click to copy

Step 3: Create a Custom Action in QRadar

Go to QRadar Admin > Define Action > Add > Custom Action Define
In the “Edit Custom Action” dialog, upload the script file created in the step above
Select “Bash” as the Interpreter value
In the “Script Parameters” section
- Leave “Parameter Name” empty
- Select the “Fixed Property” radio button and leave the “Value” field empty
- Do *not* check the “Encrypt Value” option
- Click the “Add” button and add the parameters listed in the below table
Click Save

Name	Type	Value
air_address	Fixed Property	TYPE-AIR-ADDRESS
trigger_name	Fixed Property	TYPE-TRIGGER-NAME
trigger_token	Fixed Property	TYPE-TRIGGER-TOKEN
endpoint	Network Event Property	sourceip