eclecticiq / intelligence-center-app-qradar Goto Github PK
View Code? Open in Web Editor NEWThe official EclecticIQ Intelligence Center QRadar App
Home Page: http://www.eclecticiq.com/qradar-siem-app
License: MIT License
The official EclecticIQ Intelligence Center QRadar App
Home Page: http://www.eclecticiq.com/qradar-siem-app
License: MIT License
In the app setup/config page, the required parameter "Host" requires a URI for the EIQ IC which includes the version of the API, in the format (as per our User Guide):
https://<hostname>/api/<version>
For anyone who's unaware of the new API bundled with the EIQ IC, and/or doesn't know what particular version ships with their particular version of the EIQ IC, it's unclear what URI to enter in the "Host" field.
It would be useful to:
a) Include an example in the User Guide of what the URI should look like
b) Include a screenshot or instructions on how to determine the version of the API for the EIQ IC
From IBM team
"They have found some issues, if you have any questions please get in touch."
Description of problem:
In TCs for QRadar Test Connection we do not have pointed out types of Self Signed Certificate file format that we need to use (we use now this two formats .crt and .pem),
and also it is not defined that Certificate needs to be in Chain format.
Please update documentation so that types of Self Signed Certificate file format are clear.
https://stable-tor01-vm-sa-spectre.dev.qradar.ibm.com/console/plugins/1301/app_proxy/test_connection
500 works ok on a VM
Problem per app.log:
2022-05-13 09:27:08,067 [Thread-46] [ERROR] [APP_ID:1301] [NOT:0000003000] Error occured in fetching reference table names Code: 400 Text: HttpRequestError [400]: Request to [https://10.115.113.68:443/api/reference_data/tables](https://10.115.113.68/api/reference_data/tables) resulted in SSLError with message = HTTPSConnectionPool(host='10.115.113.68', port=443): Max retries exceeded with url: /api/reference_data/tables (Caused by SSLError(CertificateError("hostname '10.115.113.68' doesn't match either of '*.dev.qradar.ibm.com', 'dev.qradar.ibm.com'",),)).
So, it looks to me the way the hostname is requested is not correct. There is a method in the SDK to do this, I cannot recall atm which one it is but let me know if you are stuck I ask the SDK team.
Currently USER_UNAUTHORIZED
is returned for all non 200 statuses
https://github.com/eclecticiq/intelligence-center-app-qradar/search?q=USER_UNAUTHORIZED
This is not helpful for debugging.
We should return the actual errors returned by the EclecticIQ API (in logs and to user in UI)
The URL provided by the system when creating a sighting uses an incorrect path and does not allow users to navigate correctly.
The URL should be updated to use the correct API path.
This URL should be, for example:
https://demo.eiq-platform.com/entity/268c2d67-111f-449d-ac77-f29f5fb88ba5
rather than
https://demo.eiq-platform.com/api/beta/entities/268c2d67-111f-449d-ac77-f29f5fb88ba5
overwriting/changing:
Line 71: Uninstalling six-1.11.0:
Line 80: Uninstalling urllib3-1.24.2:
Line 89: Uninstalling idna-2.5:
Line 102: Uninstalling charset-normalizer-2.0.4:
Line 111: Uninstalling pycparser-2.14:
Line 121: Uninstalling cffi-1.11.5:
Line 130: Uninstalling pytz-2017.2:
Line 145: Uninstalling certifi-2019.11.28:
Line 154: Uninstalling enum34-1.1.6:
Line 170: Uninstalling cryptography-3.2.1:
Line 188: Uninstalling requests-2.26.0:
If you need newer versions of libraries, that is acceptable. But it is better practice to =not=overwrite existing ones. I can see the app is built on "image": "qradar-app-base:2.1.6", so the built-in libraries are: https://www.ibm.com/docs/en/qradar-common?topic=2-qradar-app-base-image-216-packages
You cannot view/change the feeds without having to enter setup again. We should allow users to change them without having to re-enter the key and Qradar token
The app now only lets you connect if you have a valid certificate installed on your TIP. Please make a options to also allow self signed or other wise "invalid" certificates. This used to be an checkbox in the old app. This is especially useful in a test setup.
Same change as https://github.com/eclecticiq/intelligence-center-app-splunk-ta/issues/19
Docs on github point to docs portal homepage.
Navigating to QRadar documentation on EclecticIQ docs portal (for example: https://docs.eclecticiq.com/integrations/apps/ibm-qradar/install-and-configure-the-app-on-qradar) has banner that suggests documentation is obsolete and user should visit github documentation.
Circular dependency.
This leaves the user unsure about the required configuration for outgoing feeds in the EclecticIQ Intelligence Center.
a) add the link to the Reference Data Management app as this is in the screenshots
b) RE rules, firing rules on large ref data sets is not advisable without more filtering, I am not sure what users can filter on. Is there an originating IP or network they can add?
The link to the "EclecticIQ Intelligence Center User Guide" just visits the docs portal homepage.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.