QRadar n 1 QRadarlogrun pl QRadar optqradarbinlogrun pl
サンプルログとQRadarへの取り込み方法 nログ・アクティビティーから入力を作成 1. サンプルログをQRadar上に配置し、logrun. plコマンド 等を利用しQRadarに送付します。 Ø /opt/qradar/bin/logrun. pl -u 適当なIP -d QRadarのIP -f サンプルログ EPS 実行例 [root@qr 20174 q 192. 168. 112. 96 generating 100 Ctrl-c to stop [root@qr 20174 q ~]# /opt/qradar/bin/logrun. pl -u 10. 10. 10 -d -f /work/ISM_Cloud. One/ismc 000000. leef 100 messages per second to 192. 168. 112. 96: 514 ~]# 28
ログ・ソース拡張の作成例 n例：クオリティソフト ISM Cloud. One — LEEF 2. 0形式での出力とします。 https: //www. ibm. com/support/knowledgecenter/ja/SS 42 VS_DSM/c_LEEF_Form at_Guide_LEEFeventcomps. html? cp=SS 42 VS_7. 3. 0 — 区切り文字は「¦」です。 Sep 25, 2017 11: 25: 02 DESKTOP-994 OJP 5 LEEF: 2. 0|Qualitysoft|ISM Cloud. One|6. X|59 c 8692 ae 4 b 032 b 9 d 736 d 767|¦|logtype=8¦opelogtypestr=プリンター¦opetype=1¦opetypestr=印刷 ¦sev=4¦ident. Host. Name=be 7 b 1 d 5692 c 74893 b 5 f 912 fbf 834 bfb 9¦resource=DESKTOP-994 OJP 5¦user_name=里見 啓太 ¦logon_user_name=DESKTOP-994 OJP 5user¦src=192. 168. 97. 32¦file_path=¦filename=機密. txt - メモ帳 ¦file_size=¦before_change_file_name=¦before_change_file_path=¦regd_media=¦vender_name=¦product_name=¦ser ial_no=¦vender_id=¦product_id=¦process_name=NOTEPAD. EXE¦mail_service=¦mail_body=¦title_name=¦url=¦domain =¦sns_name=¦sns_postdata=¦from_mail_address=¦to_mail_address=¦cc_mail_address=¦bcc_mail_address=¦drive_i nfo=¦before_start_time=¦pc_use_time=¦system_log_info=¦print_count=1¦printer_name=Microsoft Print to PDF Sep 30, 2017 00: 00 WIN 7 X 86 LEEF: 2. 0|Qualitysoft|ISM Cloud. One|6. X|59 ce 607 be 4 b 032 b 9 d 742 d 25 a|¦|logtype=6¦opelogtypestr=PC稼働¦opetype=8¦opetypestr=時間外利用 ¦sev=2¦ident. Host. Name=bdedd 79065 c 646 e 9 a 7 e 604 afeb 503997¦resource=WIN 7 X 86¦user_name=¦logon_user_name=¦src=1 72. 16. 2. 83¦file_path=¦filename=¦file_size=¦before_change_file_name=¦before_change_file_path=¦regd_media= ¦vender_name=¦product_name=¦serial_no=¦vender_id=¦product_id=¦process_name=¦mail_service=¦mail_body=¦tit le_name=¦url=¦domain=¦sns_name=¦sns_postdata=¦from_mail_address=¦to_mail_address=¦cc_mail_address=¦bcc_m ail_address=¦drive_info=¦before_start_time=¦pc_use_time=¦system_log_info=¦print_count=¦printer_name= 51
ログ・ソース拡張の作成例 n例：エムオーテックス Lan. Scope Cat — RFC-5424形式でのSyslog出力とします。 https: //www. ipa. go. jp/security/rfc/RFC 5424 EN. html — 区切り文字は「スペース」です。 2017 -09 -21 T 15: 49: 21. 346+09: 00 APC 103213 Lan. Scope. Cat - Asset. Alert [Lan. Scope. Cat 77@49660 1<116> Category="1" Sub-Manager. No="1" Dept="Group. A" Agent. No="2" Agent="MO 103212" Logon. User="SYSTEM" Item="IPｱﾄﾞ ﾚｽ重複ｱﾗｰﾑ "172. 17. 103. 244 -UTCDate/Time="2017 -09 -21 T 06: 49: 21. 346+00: 00" Server. Received. Date/Time="201709 -21 T 15: 49: 21. 351+09: 00[" 2017 -09 -21 T 18: 09: 11. 529+09: 00 APC 103213 Lan. Scope. Cat - Asset. Alert [Lan. Scope. Cat 77@49660 1<116> Category="2" Sub-Manager. No="1" Dept="Group. A" Agent. No="2" Agent="MO 103212" Logon. User="Administrator" Item="IPｱﾄﾞﾚｽ変更ｱﾗｰﾑ "169. 254. 66. 48 → 172. 17. 103. 244 -UTCDate/Time="2017 -09 -21 T 09: 11. 529+00: 00" Server. Received. Date/Time="2017 -09 -21 T 18: 09: 11. 527+09: 00[" 2017 -09 -21 T 17: 28: 10. 087+09: 00 APC 103213 Lan. Scope. Cat - Asset. Alert [Lan. Scope. Cat 77@49660 1<116> Category="3" Sub-Manager. No="1" Dept="Group. A" Agent. No="2" Agent="MO 103212" Logon. User="SYSTEM" Item="ﾘｰｽ切 れｱﾗｰﾑ -ﾘｰｽ期限 88)2017/12/18日前 "(UTCDate/Time="2017 -09 -21 T 08: 28: 10. 087+00: 00" Server. Received. Date/Time="2017 -09 -21 T 17: 28: 10. 090+09: 00[" 2017 -09 -21 T 15: 56: 45. 997+09: 00 APC 103213 Lan. Scope. Cat - Asset. Alert [Lan. Scope. Cat 77@49660 1<116> Category="4" Sub-Manager. No="1" Dept="Group. A" Agent. No="2" Agent="MO 103212" Logon. User="Administrator" Item="新規ｱﾌﾟﾘｹｰｼｮﾝｲﾝｽﾄｰﾙ -Win. Merge 2. 14. 0. 80 x 64" UTCDate/Time="2017 -09 -21 T 06: 56: 45. 997+00: 00" Server. Received. Date/Time="2017 -09 -21 T 15: 56: 45. 999+09: 00[" 71
ログ・ソースオーバーライドの作成例 n例：トレンドマイクロ Deep Security — QRadarで用意されているDSMはLEEF対応のものですが、本検証では CEFのログが使用される想定で既存のDeep. Securityのログ・ソースを オーバーライドします。 — 区切り文字はスペースです。 Aug 23 22: 10: 03 10. 3. 241. 244 Aug 23 21: 52: 50 WIN-165 MOSRFAMO CEF: 0|Trend Micro|Deep Security Agent|9. 6. 3175|123|Out Of Allowed Policy|5|cn 1=165 cn 1 Label=Host ID dvc=10. 3. 243. 147 Trend. Micro. Ds. Tenant=Tenant. ID 0 Trend. Micro. Ds. Tenant. Id=0 act=Deny dmac=01: 00: 5 E: 00: 01 smac=00: 56: BA: 7 F: 4 F Trend. Micro. Ds. Frame. Type=IP src=192. 168. 7. 220 dst=224. 0. 0. 1 in=50 cs 3= cs 3 Label=Fragmentation Bits proto=IGMP spt=0 dpt=0 cnt=1 Aug 23 22: 10: 03 10. 3. 241. 244 Aug 23 21: 54: 55 WIN-165 MOSRFAMO CEF: 0|Trend Micro|Deep Security Agent|9. 6. 3175|123|Out Of Allowed Policy|5|cn 1=165 cn 1 Label=Host ID dvc=10. 3. 243. 147 Trend. Micro. Ds. Tenant=Tenant. ID 0 Trend. Micro. Ds. Tenant. Id=0 act=Deny dmac=01: 00: 5 E: 00: 01 smac=00: 56: BA: 7 F: 4 F Trend. Micro. Ds. Frame. Type=IP src=0. 0 dst=0. 0 in=0 cs 3= cs 3 Label=Fragmentation Bits proto=IGMP spt=0 dpt=0 cnt=1 Aug 23 22: 10: 03 10. 3. 241. 244 Aug 23 21: 57: 00 WIN-165 MOSRFAMO CEF: 0|Trend Micro|Deep Security Agent|9. 6. 3175|123|Out Of Allowed Policy|5|cn 1=165 cn 1 Label=Host ID dvc=10. 3. 243. 147 Trend. Micro. Ds. Tenant=Tenant. ID 0 Trend. Micro. Ds. Tenant. Id=0 act=Deny dmac=01: 00: 5 E: 00: 01 smac=00: 56: BA: 7 F: 4 F Trend. Micro. Ds. Frame. Type=IP src=192. 168. 7. 220 dst=224. 0. 0. 1 in=50 cs 3= cs 3 Label=Fragmentation Bits proto=IGMP spt=0 dpt=0 cnt=1 79
![Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a search -c 17 -r "Cloud. One"](http://slidetodoc.com/presentation_image/003b87c9cba857a0e501d4815ecf7d0f/image-90.jpg "Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a search -c 17 -r \"Cloud. One\"")
Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a search -c 17 -r "Cloud. One" [INFO] Initializing Content Management Tool. . . [INFO] (Content. Management. CLI) Start Time: 2017 -12 -12 18: 32: 36 [INFO] Starting search process [INFO] Search results: [INFO] - [Id] - [Name] - [Description] [INFO] - [212] - [ISM Cloud. One] - [] [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a search -c 16 -r "Cloud. One" [INFO] Initializing Content Management Tool. . . [INFO] (Content. Management. CLI) Start Time: 2017 -12 -12 18: 36: 24 [INFO] Starting search process [INFO] Search results: [INFO] - [Id] - [Name] - [Description] [INFO] - [1] - [ISMCloud. One. Custom_ext] - [] 90
![Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a export -c 17 -i 212 [INFO]](http://slidetodoc.com/presentation_image/003b87c9cba857a0e501d4815ecf7d0f/image-92.jpg "Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a export -c 17 -i 212 [INFO]")
Tips [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a export -c 17 -i 212 [INFO] Initializing Content Management Tool. . . [INFO] (Content. Management. CLI) Start Time: 2017 -12 -12 18: 38: 29 [INFO] Starting export process [INFO] Processing Export: content-type 17 id 212 [INFO] Exporting content of type [sensordevice] with id [212] [INFO] Export Summary: [INFO] Content Type - [Number of items exported] [INFO] - sensordevicetype - [1] [INFO] - sensordevicecategory - [1] [INFO] - sensordevice - [1] [INFO] - device_ext - [1] [INFO] SUCCESS: Compressed exported bundle can be found here /work/bkup/sensordevice-Content. Export 20171212183830. zip [root@qradar 97 bkup]# /opt/qradar/bin/content. Management. pl -a export -c 16 -i 1 [INFO] Initializing Content Management Tool. . . [INFO] (Content. Management. CLI) Start Time: 2017 -12 -12 18: 40: 27 [INFO] Starting export process [INFO] Processing Export: content-type 16 id 1 [INFO] Exporting content of type [device_ext] with id [1] [INFO] Export Summary: [INFO] Content Type - [Number of items exported] [INFO] - sensordevicetype - [1] [INFO] - sensordevicecategory - [1] [INFO] - sensordevice - [1] [INFO] - device_ext - [1] [INFO] SUCCESS: Compressed exported bundle can be found here /work/bkup/device_ext-Content. Export 20171212184028. zip [root@qradar 97 bkup]# ls device_ext-Content. Export-20171212184028. zip sensordevice-Content. Export-20171212183830. zip 92
Tips n. DSMの削除 カスタム・ログソースを削除するためには、コマンドライン からpsqlコマンドを実行する必要があります。 2. Ø 以下のコマンドを実行し、カスタム・ログソースを削除し ます。 psql -U qradar -t. A -c “UPDATE sensordevicetype SET devicecategoryid = 6 WHERE devicetypedescription = ‘削除したいログソースの名前'; " [root@qradar 97 ~]# psql -U qradar -ta -c "UPDATE sensordevicetype SET devicecategoryid = 6 WHERE devicetypedescription = 'TEST_LOGSOURCE_1'; " UPDATE sensordevicetype SET devicecategoryid = 6 WHERE devicetypedescription = 'TEST_LOGSOURCE_1'; UPDATE 1 [root@qradar 97 ~]# 94
Tips nプロパティーについて DSMエディターで表示されているプロパティーは、u. DSMのXMLで記入する名前 と異なる場合があります。 DSMエディターでの名称（英語名） XMLでの名称 IPv 6宛先(IPv 6 Destination) Destination. Ipv 6 IPv 6送信元(IPv 6 Source) Source. Ipv 6 NAT後の宛先IP(Post NAT Destination IP) Destination. Ip. Post. NAT後の宛先ポート(Post NAT Destination Port) Destination. Port. Post. NAT後の送信元IP(Post NAT Source IP) Source. Ip. Post. NAT後の送信元ポート(Post NAT Source Port) Source. Port. Post. NAT前の宛先IP(Pre NAT Destination IP) Destination. Ip. Pre. NAT前の宛先ポート(Pre NAT Destination Port) Destination. Port. Pre. NAT前の送信元IP(Pre NAT Source IP) Source. Ip. Pre. NAT前の送信元ポート(Pre NAT Source Port) Source. Port. Pre. NAT アイデンティティーIP(Identity IP) Identity. Ip アイデンティティーIPv 6(Identity IPv 6) Identity. Ipv 6 アイデンティティーMAC(Identity MAC) Identity. MAC アイデンティティーNet. BIOS名(Identity Net BIOS Name) Net. BIOSName 96
Tips nプロパティーについて DSMエディターでの名称（英語名） XMLでの名称 アイデンティティー・グループ名(Identity Group Name) Group. Name アイデンティティー・ホスト名(Identity Host Name) Host. Name アイデンティティー拡張フィールド(Identity Extended Field) Extra. Identity. Data イベントID(Event ID) Event. Name イベント・カテゴリー(Event Category) Event. Category プロトコル(Protocol) Protocol ユーザー名(Username) User. Name ログ・ソースの時刻(Log Source Time) Device. Time 宛先IP(Destination IP) Destination. Ip 宛先MAC(Destination MAC) Destination. MAC 宛先ポート(Destination Port) Destination. Port 送信元IP(Source IP) Source. Ip 送信元MAC(Source MAC) Source. MAC 送信元ポート(Source Port) Source. Port 97
- Slides: 97