IBM QRadar via Logstash¶

Example overview¶

Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:

• Log collector: accepts logs from several sources and forwards logs to the SIEM system

• SIEM system: used to analyze logs and monitor the system status

In the provided example, events are sent via webhooks to the Logstash log collector and forwarded to the QRadar SIEM system.

Used resources¶

• Logstash 7.7.0 installed on Debian 10.4 (Buster) and available on https://logstash.example.domain.com

• QRadar V7.3.3 installed on Linux Red Hat and available with the IP address https://109.111.35.11:514

• Administrator access to Wallarm Console in EU cloud to configure the webhook integration

Since the links to the Logstash and QRadar services are cited as examples, they do not respond.

Logstash configuration¶

Logstash is configured in the logstash-sample.conf file:

• Incoming webhook processing is configured in the input section:

  • Traffic is sent to port 5044
  • Logstash is configured to accept only HTTPS connections
  • Logstash TLS certificate signed by a publicly trusted CA is located within the file /etc/server.crt
  • Private key for TLS certificate is located within the file /etc/server.key

• Forwarding logs to QRadar and log output are configured in the output section:

  • All event logs are forwarded from Logstash to QRadar at the IP address https://109.111.35.11:514
  • Logs are forwarded from Logstash to QRadar in the JSON format according to the Syslog standard
  • Connection with QRadar is established via TCP
  • Logstash logs are additionally printed on the command line (15^th code line). The setting is used to verify that events are logged via Logstash

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

input {
  http { # input plugin for HTTP and HTTPS traffic
    port => 5044 # port for incoming requests
    ssl => true # HTTPS traffic processing
    ssl_certificate => "/etc/server.crt" # Logstash TLS certificate
    ssl_key => "/etc/server.key" # private key for TLS certificate
  }
}
output {
  syslog { # output plugin to forward logs from Logstash via Syslog
    host => "109.111.35.11" # IP address to forward logs to
    port => "514" # port to forward logs to
    protocol => "tcp" # connection protocol
    codec => json # format of forwarded logs
  }
  stdout {} # output plugin to print Logstash logs on the command line
}

A more detailed description of the configuration files is available in the official Logstash documentation.

Testing Logstash configuration

To check that Logstash logs are created and forwarded to QRadar, the POST request can be sent to Logstash.

Request example:

curl -X POST 'https://logstash.example.domain.com' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'

Logstash logs:

QRadar logs:

QRadar log payload:

QRadar configuration (optional)¶

In QRadar, the log source is configured. It helps to easily find Logstash logs in the list of all logs in QRadar, and can also be used for further log filtering. The log source is configured as follows:

• Log Source Name: Logstash

• Log Source Description: Logs from Logstash

• Log Source Type: type of incoming logs parser used with Syslog standard Universal LEEF

• Protocol Configuration: standard of logs forwarding Syslog

• Log Source Identifier: Logstash IP address

• Other default settings

A more detailed description of the QRadar log source setup is available in the official IBM documentation.

Configuration of webhook integration¶

• Webhooks are sent to https://logstash.example.domain.com

• Webhooks are sent via POST requests

• Additional authentication parameter X-Auth-Token is passed in the request

• Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

Example testing¶

To test the configuration, a new user is added in Wallarm Console:

Logstash will log the event as follows:

The following data in JSON format will be displayed in the QRadar log payload: