Book Image

Building a Next-Gen SOC with IBM QRadar

By : Ashish M Kothekar
Book Image

Building a Next-Gen SOC with IBM QRadar

By: Ashish M Kothekar

Overview of this book

This comprehensive guide to QRadar will help you build an efficient security operations center (SOC) for threat hunting and need-to-know software updates, as well as understand compliance and reporting and how IBM QRadar stores network data in real time. The book begins with a quick introduction to QRadar components and architecture, teaching you the different ways of deploying QRadar. You’ll grasp the importance of being aware of the major and minor upgrades in software and learn how to scale, upgrade, and maintain QRadar. Once you gain a detailed understanding of QRadar and how its environment is built, the chapters will take you through the features and how they can be tailored to meet specifi c business requirements. You’ll also explore events, flows, and searches with the help of examples. As you advance, you’ll familiarize yourself with predefined QRadar applications and extensions that successfully mine data and find out how to integrate AI in threat management with confidence. Toward the end of this book, you’ll create different types of apps in QRadar, troubleshoot and maintain them, and recognize the current security challenges and address them through QRadar XDR. By the end of this book, you’ll be able to apply IBM QRadar SOC’s prescriptive practices and leverage its capabilities to build a very efficient SOC in your enterprise.
Table of Contents (18 chapters)
1
Part 1: Understanding Different QRadar Components and Architecture
5
Part 2: QRadar Features and Deployment
10
Part 3: Understanding QRadar Apps, Extensions, and Their Deployment

Exploring flow data

Flows are different from events. Flow data is the information of the session between two hosts. For example, if an employee logs in at 9 a.m. and starts using social media, QRadar can capture these session details between the employee’s machine and the social media site. This is done by capturing the network traffic from the span port of a switch. There are different types of flows, which we will discuss in detail later in Chapter 4. Flow data can be viewed in the Network Activity tab on the QRadar UI, as shown in the following screenshot:

Figure 1.2 – Network Activity tab

Figure 1.2 – Network Activity tab

Similar to an Event Processor, we have a Flow Processor and Flow Collector for flow data. Let’s discuss them in detail next.

Flow Processor

Like the Event Processor, the Flow Processor is another managed host that collects and processes flow data. It has an ariel database where the flow data is stored, and it can be queried using the same mechanism as discussed for the Event Processor.

For the Event Processor, we had ecs-ec-ingress, which collected event data. But for the Flow Processor, we have the qflow service, which collects flows and then sends them to ecs-ec and ecs-ep for further processing and storage.

Important services running on the Flow Processor are as follows:

  • hostcontext: For the Flow Processor, the 'COMPONENT_PROCESSES' parameter in the /opt/qradar/conf/nva_hostcontext.conf file has different values than in the Event Processor.
  • qflow: This service is responsible for collecting the flows. The Flow Processor does NOT have the ecs-ec-ingress service
  • hostservices: Same as in the Console.

Important note

A single managed host can act as both an Event Processor and Flow Processor. For this to happen, you need to choose the correct option while installing. Usually, on enterprise-level deployments, Event Processors and Flow Processors are kept separate.

Flow Collector

Like an Event Collector, a Flow Collector is used to collect flow data, analyze it, and send it to the Flow Processor or Console for processing.

The Flow Collector has a special service like Flow Processor called qflow, which collects flows. Flow sources are defined on the QRadar Console UI and then the configuration is pushed to managed hosts, thus the Flow Collector understands which flows need to be collected.

Important services running on the Flow Collector are as follows:

  • hostcontext: The subservices of the hostcontext service are as follows:
    • qflow – This service is responsible for collecting flows
    • ecs-ec – This service is responsible for aggregating and analyzing flows
  • hostservices: Same as in the Console

Another important component usually used in huge deployments is the Data Node. Let's see why in the next section.