IBM QRadar via Fluentd¶

These instructions provide you with the example integration of Wallarm with the Fluentd data collector to further forward events to the QRadar SIEM system.

The most common logging scheme in complex systems consists of the following components:

Data collector: accepts logs from several sources and forwards logs to the SIEM system
SIEM system or log management systems: used to analyze logs and monitor the system status

Used resources¶

Fluentd installed on Debian 11.x (bullseye) and available on https://fluentd-example-domain.com
QRadar V7.3.3 installed on Linux Red Hat and available with the IP address https://109.111.35.11:514
Administrator access to Wallarm Console in EU cloud to configure the Fluentd integration

Wallarm Cloud IP addresses

To provide Wallarm Cloud access to your system, you may need a list of its public IP addresses:

US CloudEU Cloud

34.94.85.217
34.94.51.234
34.102.59.122

34.141.230.156
34.91.138.113
34.90.114.134
35.204.127.78

Since the links to the Fluentd and QRadar services are cited as examples, they do not respond.

Fluentd configuration¶

Since Wallarm sends logs to the Fluentd intermediate data collector via webhooks, the Fluentd configuration should meet the following requirements:

Accept the POST or PUT requests
Accept HTTPS requests
Have public URL
Forward logs to IBM Qradar, this example uses the remote_syslog plugin to forward logs

Fluentd is configured in the td-agent.conf file:

Incoming webhook processing is configured in the source directive:
- Traffic is sent to port 9880
- Fluentd is configured to accept only HTTPS connections
- Fluentd TLS certificate signed by a publicly trusted CA is located within the file /etc/ssl/certs/fluentd.crt
- Private key for TLS certificate is located within the file /etc/ssl/private/fluentd.key
Forwarding logs to QRadar and log output are configured in the match directive:
- All event logs are copied from Fluentd and forwarded to QRadar at the IP address https://109.111.35.11:514
- Logs are forwarded from Fluentd to QRadar in the JSON format according to the Syslog standard
- Connection with QRadar is established via TCP
- Fluentd logs are additionally printed on the command line in JSON format (19-22 code lines). The setting is used to verify that events are logged via Fluentd

<source>
  @type http # input plugin for HTTP and HTTPS traffic
  port 9880 # port for incoming requests
  <transport tls> # configuration for connections handling
    cert_path /etc/ssl/certs/fluentd.crt
    private_key_path /etc/ssl/private/fluentd.key
  </transport>
</source>
<match **>
  @type copy
  <store>
      @type remote_syslog # output plugin to forward logs from Fluentd via Syslog
      host 109.111.35.11 # IP address to forward logs to
      port 514 # port to forward logs to
      protocol tcp # connection protocol
    <format>
      @type json # format of forwarded logs
    </format>
  </store>
  <store>
     @type stdout # output plugin to print Fluentd logs on the command line
     output_type json # format of logs printed on the command line
  </store>
</match>

A more detailed description of configuration files is available in the official Fluentd documentation.

Testing Fluentd configuration

To check that Fluentd logs are created and forwarded to QRadar, the PUT or POST request can be sent to Fluentd.

Request example:

curl -X POST 'https://fluentd-example-domain.com' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'

Fluentd logs:

QRadar logs:

QRadar log payload:

QRadar configuration (optional)¶

In QRadar, the log source is configured. It helps to easily find Fluentd logs in the list of all logs in QRadar, and can also be used for further log filtering. The log source is configured as follows:

Log Source Name: Fluentd
Log Source Description: Logs from Fluentd
Log Source Type: type of incoming logs parser used with Syslog standard Universal LEEF
Protocol Configuration: standard of logs forwarding Syslog
Log Source Identifier: Fluentd IP address
Other default settings

A more detailed description of QRadar log source setup is available in the official IBM documentation.

Configuration of Fluentd integration¶

Webhooks are sent to https://fluentd-example-domain.com
Webhooks are sent via POST requests
The webhook integration has default advanced settings
Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

More details on the Fluentd integration configuration

Example testing¶

To test the configuration, a new user is added in Wallarm Console:

Fluentd will log the event as follows:

The following data in JSON format will be displayed in the QRadar log payload: