Qradar
Unofficial third-party scripts, playbooks, and content for IBM QRadar & QRadar Community Edition.
Install / Use
/learn @josh-morin/QradarREADME
Contents
Custom Action Scripts
Short Message Service
sms.sh
Send text messages from QRadar ”Custom Actions” using Twilio API in a bash file.
Setup
- Create an account from http://www.twilio.com
- Retrieve Phone number, Id, and Token generated under your dashboard
- Apply Phone number, Id, and Token into script
- Call script into QRadar, see QRadar setup below
QRadar Setup
- Go to Admin tab and select Define Actions under Custom Actions
- Select Add from top menu options
- Provide the following:
- Name
- Description
- Interpreter: Bash
- Upload SMS Bash/Curl script
- Parameter Name
- Fix Property Value
- Click Add
- Click Save
Custom Configurations
arielRightClick.properties
To add these entries into the ariel right-click menu, copy this file into /opt/qradar/conf and restart tomcat.
The following options are included:
- Bluecoat
- Cisco Talos
- DomainTools
- Google Cached View
- LOLBAS
- Maclookup
- Robtex
- SpeedGuide
- ThreatCrowd
- URLVoid
- Userstack
- VeriSign
ip_context_menu.xml
To add these entries into the right-click menu, copy this file into /opt/qradar/conf and restart tomcat.
The following options are included:
- Nmap
- Ping
- Traceroute
- X-Force Exchange
- AbuseIPDB
- AlienVault OTX
- Censys
- Cisco Talos
- DNSlytics
- DShield
- Google Safe Browsing
- GreyNoise
- IPVoid
- MxToolBox Blacklist
- Project Honey Pot
- Robtex
- Shodan
- Spamhaus Reputation Checker
- ThreatCrowd
- ThreatMiner
- VirusTotal
network_hierarchy.json
This is a starter template for Network hierarchy with "Address-Methods" that contains Loopback addresses, Multicast, and Unicast via IPv4 and IPv6. It also has the default "Net-10-172-192" only. Always remember to add geo coordinates.
Remote Automation
qradar_check.py
Gathers information and presents an HTML status report about your QRadar deployment.
Resources
Resources & Content by IBM
Unofficial Resources
Disclaimer
All content is without warranty of any kind. Use at your own risk. I assume no liability for the accuracy, correctness, completeness, usefulness, or any damages.
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies.
