Step 11 (optional). Configuring Kaspersky CyberTrace App for QRadar

You can configure Kaspersky CyberTrace App for QRadar by selecting the Settings link in QRadar Console.

Settings link

You specify the settings in a form that appears after you select the Settings link.

Settings form

The following settings fields are available:

• QRadar authentication token

  The authentication token to access QRadar RestApi.

  You can specify an existing token or create a new token.

• Kaspersky CyberTrace Service connection string

  The IP address and port that Kaspersky CyberTrace Service listens on for incoming events.

  If you have installed Kaspersky CyberTrace on the same computer on which QRadar is installed, Kaspersky CyberTrace App for QRadar will not be able to connect to QRadar because the iptables rules forbid the communication of a Docker container, in which Kaspersky CyberTrace App for QRadar is running, and the QRadar computer.

  To make Kaspersky CyberTrace App for QRadar work on the QRadar computer, connect to the QRadar computer using the SSH protocol and run the following command:

  iptables -I INPUT -i <D_interface> -p tcp --destination-port <FS_port> -j ACCEPT

  This command includes:

  • <D_interface>—Interface of the Docker container that contains Kaspersky CyberTrace App for QRadar.

    To find the <D_interface> name, perform the following:

    1. Find the identifier of Kaspersky CyberTrace App for QRadar by running the following command:

       psql -U qradar -c "select id, name from installed_application;"

       A table appears. Find the value for the identifier of Kaspersky CyberTrace App for QRadar (hereinafter <app_id>) from the id column.

    2. Find the identifier of the Docker container in which Kaspersky CyberTrace App for QRadar is contained by running the following command:

       docker ps

       In the output result, find the image with the .../qapp/<app_id>:x.x.x name, where x.x.x is the installed version of Kaspersky Threat Feed App, and find its CONTAINER ID value (hereinafter <container_id>).

    3. Find the interface name for the Docker image that contains Kaspersky CyberTrace App for QRadar, by running the following command:

       docker inspect <container_id> | grep NetworkMode

       The output result appears, in the format "NetworkMode": "<D_interface>". Substitute this result for <D_interface> in the command above.

  • <FS_port>—Port that Kaspersky CyberTrace Service listens on for incoming events.

  If you run the above command, the added rule will be present in iptables only until iptables is restarted, or the QRadar computer is restarted. To add this rule permanently, add it to the /etc/sysconfig/iptables file (the path to the iptables file depends on the environment configuration).

  Also note that you cannot specify the 127.0.0.1 IP address even if Kaspersky CyberTrace App for QRadar is installed on the QRadar computer. Specify the external IP address of the QRadar computer instead.

• Kaspersky CyberTrace Service log source name

  The log source name of Kaspersky CyberTrace Service as it is registered in QRadar. This name is displayed in the Name column of the window that opens after Admin > Log Sources is selected in QRadar Console.

  If the Kaspersky CyberTrace Service log source was added automatically when you sent the initial set of Kaspersky CyberTrace Service events to QRadar, the log source name is Kaspersky Threat Feed Service @ [id], where [id] is the identifier of Kaspersky CyberTrace Service events. (By default, [id] is KL_Threat_Feed_Service_v2). If you had to add Kaspersky CyberTrace Service to QRadar as a log source manually because you did not have the latest QRadar updates, the log source name is [id]; that is, KL_Threat_Feed_Service_v2 by default.

  It takes some time to visualize the requested data after you have changed the log source name or the installed Kaspersky CyberTrace App for QRadar. While the data is being loaded, a progress bar is displayed. The time required for getting all the data depends on the selected period over which the data is visualized.

After you configure Kaspersky CyberTrace App for QRadar, you can run the verification test by clicking the Run self-test button.

Self-test results

A test result of Failed for any feed means that a tested object is assigned to an incorrect category. The error can originate, for example, in an incorrect configuration file.