AiStrike Documentation
AiStrike Documentation
Breadcrumbs

IBM QRadar

This document outlines the steps required to integrate AiStrike with your QRadar instance. The integration allows AiStrike to fetch security events and alerts via the QRadar API for enrichment and analysis.◼︎

Prerequisites

Before configuring forwarding and routing rules, please provide the following details and ensure you have the required access:

  • QRadar Public IP Address

    • The public IP address from which your QRadar server will send alerts & syslog events (Primary & Secondary).

    • Optional: This is required so we can allowlist your IP on our Syslog collector.

  • QRadar Administrative Access

    • You must have an admin-level user account in QRadar with permissions to:

      • Create and manage log source forwarding rules

      • Configure routing rules

      • Create or manage the AiStrike API user account

      • Generate and retrieve API tokens

1. Network Access to QRadar

AiStrike requires API access to QRadar over HTTPS (port 443) or your custom-configured port.

Note: For on-prem deployments, please ensure that your firewall and any network control systems allow the necessary traffic based on your environment's configuration.

Firewall Configuration

NAT Configuration for Firewall Public IP to Internal QRadar IP: If you have an Internal IP on QRadar, you can configure a Destination NAT forwarding via a Public IP on your firewall to send connections to an internal IP (QRadar Server Console).

Please ensure the following AiStrike IP addresses are allowlisted to access your QRadar API endpoint:

3.135.165.25/32
3.148.24.98/32
3.148.93.249/32
3.14.192.137/32
13.201.28.59/32
18.223.178.199/32
52.15.138.222/32
54.246.180.34/32
63.35.37.74/32
54.220.227.162/32

Optional: If you are unable to do Destination NAT, you can discuss with AiStrike about establishing a dedicated VPN connection for this integration & share VPN config (AWS Site-to-Site VPN). Feel free to reach out to the AiStrike team to discuss available options.

2. Set QRadar Permissions

To ensure secure and scoped access, it is recommended to create a dedicated user and security profile for AiStrike.

3. Create an AiStrike Role

  1. In QRadar, click the menu icon in the top-left corner.

  2. Navigate to Admin > User Management > Users Roles.

  3. Click New to create a new role:

    • Assign a role name (e.g., Aistrike_Role).

    • Assign Monitor, View, Read-only and dashboard etc.

  4. Click "Save" to save the role.

4. Create an AiStrike Security Profile

  1. Go to Admin > User Management > Security Profiles.

  2. Click New Profile.

  3. Configure the profile (AiStrike_Profile) with the following settings:

    • Permission Precedence: No Restrictions

    • Log Sources: All Log Source Groups

    • Network: All

    • Domains: All Domains

Save the profile and assign it to the user you created above.

5. Create an AiStrike User

  1. In QRadar, click the menu icon in the top-left corner.

  2. Navigate to Admin > User Management > Users.

  3. Click New to create a new user:

    • Assign a username (e.g., Aistrike_User, Email: threat@aistrike.com).

    • Assign a strong password.

    • User Role > AiStrike_Role

    • Security Profile > AiStrike_Profile

6. Deploy Changes

Click Deploy to apply user and profile changes.

7. Create an Authorized Service Token

  1. Navigate to Admin > User Management > Authorized Services.

  2. Click Add Authorized Service.

  3. Configure with the following settings:

    • Service Name: AIStrike_Integration

    • User Role: AiStrike_Role (or select the user role associated with Aistrike_User)

    • Security Profile: The profile you created above

    • Expiry Date: No Expiry (or set based on your policy)

  4. After saving, a token (authentication key) will be generated.

    • Copy and store this token securely.

    • This token is required for completing the integration in the AiStrike platform.

Set up for Event Log forwarding

NOTE: If the setup required you to send events for a domain or all domains

8. Steps to Create a Forwarding Destination

  1. Log in to QRadar Console

    • Access the QRadar web interface with an admin account.

  2. Navigate to Admin Panel

    • Click Admin on the top navigation bar.

  3. Open Forwarding Destinations

    • In the System Configuration, click Forwarding Destinations.

    • Define forwarding destination for AiStrike (e.g., AiStrike_Forwarding_Destination).

  4. To create a new destination:

    • Click Add.

    • Enter the destination name, IP address, port, and protocol.

    • Click Save.

9. Steps to Create a Routing Rule

From the Admin panel, click Routing Rules under the System Configuration section.

  1. Create a New Rule

    • Click Add.

  2. Configure the Rule Details

    • Rule Name: Provide a descriptive name (e.g., AiStrike_Routing_Rule).

    • Rule Type: Select Forwarding Rule.

  3. Define Rule Conditions

    • Use the filters to specify which events to forward.

    • Combine multiple conditions as needed.

  4. Select Forwarding Destination

    • Under Forwarding Destination, select the destination(s) you created earlier.

  5. Save the Rule

    • Click Save to enable the rule.

10. Configuration in AiStrike App

In your AiStrike console, go to the QRadar integration settings and enter:

  • Configuration name

  • The QRadar API/Server endpoint URL (e.g., https://<qradar-host>/api/)

  • API Version

  • Authentication token (Authorized Service Token)

  • (Optional) Username [e.g., Aistrike_User]

  • (Optional) Password

Once saved, AiStrike will begin fetching relevant data from QRadar.