IBM Cloud Pak for Security as a Service

https://www.ibm.com/docs/en/cloud-pak-sec-aas
Admin
IBM Cloud Pak for Security as a Service is an IBM offering that helps organizations integrate and...
Tokens:223,089
Snippets:1,887
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### Verify Installed Packages

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages

These commands verify the installation of specific packages by checking their version information. This is a general approach and can be adapted for any installed package.

```bash
rsync --version
```

```bash
screen --version
```

```bash
snmpd --version
```

--------------------------------

### Install createrepo Package (Bash)

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software

Installs the 'createrepo' package using yum. This is a prerequisite for installing the standalone software in certain environments. It ensures that the necessary repository creation tools are available.

```bash
sudo yum install -y createrepo
```

--------------------------------

### Install container-selinux on RHEL 7 (Bash)

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software

Installs the 'container-selinux' package on Red Hat Enterprise Linux 7. This step is required before installing the standalone software and involves enabling specific repositories.

```bash
sudo subscription-manager repos --enable=rhel-7-server-extras-rpms &&\
sudo yum install container-selinux
```

--------------------------------

### Install container-selinux on RHEL 8 (Bash)

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software

Installs the 'container-selinux' package on Red Hat Enterprise Linux 8. This is a prerequisite for the standalone software installation and requires enabling the RHEL 8 appstream repository.

```bash
sudo subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms &&\
sudo yum install container-selinux
```

--------------------------------

### AQL Query with LIMIT, START, and STOP Clauses

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=explorer-building-search-queries

This AQL query demonstrates the use of `LIMIT`, `START`, and `STOP` clauses to control the number of results returned and the time range for the query. It selects all fields from events, limits results to 20, and specifies a start and stop time.

```aql
SELECT *
FROM events
LIMIT 20
START '2021-01-01 00:00'
STOP '2021-01-01 01:00'
```

--------------------------------

### Install Edge Gateway Software

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=iss-apps-only-standalone-software-in-air-gap-environment

This command initiates the installation of the Edge Gateway software using the `manageAppHost` utility. It requires pairing information, the registry URL, and username for authentication, and configures the Edge Gateway to use the specified private registry.

```bash
sudo manageAppHost install -p <pairing information.json> --registry <registry_URL> --user <username>
```

--------------------------------

### Install Edge Gateway Standalone Software (Bash)

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-standalone-software

Executes the Edge Gateway installation script. This command requires the actual version number to be specified in the filename `apphost-<x.x.x>.run`, where `x.x.x` represents the version.

```bash
sudo bash apphost-<x.x.x>.run
```

--------------------------------

### Sample Queries for Dummy Data Sources

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=connectors-stix-bundle

These are example queries designed to retrieve data from dummy data source connections. They are based on sample data provided within the URLs and demonstrate filtering by IP address, network traffic, destination port, and user ID. These queries will only return results if they match the predefined sample data.

```generic
[ ipv4-addr:value != '127.0.0.1' ]
[ network-traffic:src_ref.value != '127.0.0.1' ]
[ network-traffic:dst_port = 443 ]
[ user-account:user_id = 'test' ]
```

--------------------------------

### Verify Edge Gateway Version

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-upgrading-edge

This command checks the current installed version of the Edge Gateway. It is a prerequisite before starting the upgrade process. No specific input is required, and the output is the version string.

```bash
manageAppHost --version
```

--------------------------------

### Install K3s Airgap Images

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-virtual-appliance-in-air-gap-environment

This procedure involves creating a directory for K3s agent images and copying the downloaded `k3s-airgap-images` tar file into it. This prepares K3s to run in an air-gapped environment by providing necessary images locally. Replace `<k3s-airgap-images tar file>` with the actual file name.

```bash
sudo mkdir -p /var/lib/rancher/k3s/agent/images/
sudo cp <k3s-airgap-images tar file> /var/lib/rancher/k3s/agent/images/
```

--------------------------------

### Example: QRadar Local CA Certificate Chain

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=ccq-determining-whether-your-certificate-is-internally-signed-custom-signed

This output indicates that the QRadar console is using an internally signed certificate signed by the QRadar Root CA and QRadar Local CA. This output guides the user to follow specific steps for downloading and adding certificates.

```text
CONNECTED(00000003)
depth=2 CN = QRadar Local Root CA
verify return:1
depth=1 CN = QRadar Local CA
verify return:1
depth=0 CN = qradar-742-console.example.ibm.com
verify return:1
—
Certificate chain
0 s:/CN=qradar-742-console.example.ibm.com
  i:/CN=QRadar Local CA
```

--------------------------------

### AQL Query Example for IBM QRadar

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=explorer-building-search-queries

This AQL query retrieves specific event details such as magnitude, source IP, destination IP, destination port, event name, log source, category name, and start time. It filters events based on text search for '127.0.0.1' and limits the results to 1000, looking back over the last 2 hours.

```aql
SELECT magnitude, sourceip, destinationip, destinationport, QIDNAME(qid) 
AS 'Event Name', LOGSOURCENAME(logsourceid) 
AS 'Log Source', CONCAT(CATEGORYNAME(highLevelCategory), '.', CATEGORYNAME(category)) 
AS 'Category Name', DATEFORMAT(startTime, 'MMM dd hh:mm a') 
AS 'Start Time' 
FROM events 
WHERE TEXT SEARCH '127.0.0.1' 
LIMIT 1000 
LAST 2 HOURS
```

--------------------------------

### Recreate Edge Gateway Instance with manageAppHost install

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-pairing-security-qradar-suite-software-account-edge-gateway

This command is used to recreate an Edge Gateway instance if the pairing information is regenerated for an active gateway. It requires the `manageAppHost install` command to be executed.

```bash
manageAppHost install
```

--------------------------------

### Create Local Yum Repository

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages

This command executes a run file to create or update a local Yum repository named 'apphost_optional'. Ensure you replace '<version>' with the appropriate version number.

```bash
sudo bash ./apphost-ova-optional-packages-repo-<version>.run
```

--------------------------------

### Install Package on RHEL 8

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages

This command installs the 'net-snmp' package on a Red Hat Enterprise Linux 8 system. It explicitly disables all other repositories and enables only 'apphost_optional' to ensure the package is installed from the local repository.

```bash
sudo yum --disablerepo="*" --enablerepo="apphost_optional" install net-snmp
```

--------------------------------

### GET /v0/event_mappings

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory

Gets multiple records from the event_mappings table.

```APIDOC
## GET /v0/event_mappings

### Description
Gets multiple records in event_mappings table.

### Method
GET

### Endpoint
/v0/event_mappings

### Parameters
No parameters are specified in the provided documentation.

### Request Body
No request body is specified in the provided documentation.

### Request Example
{
  "example": ""
}

### Response
#### Success Response (200)
- No response fields are specified in the provided documentation.

#### Response Example
{
  "example": ""
}
```

--------------------------------

### GET /v0/qid_records

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory

Gets multiple records from the qid_records table.

```APIDOC
## GET /v0/qid_records

### Description
Gets multiple records in qid_records table.

### Method
GET

### Endpoint
/v0/qid_records

### Parameters
No parameters are specified in the provided documentation.

### Request Body
No request body is specified in the provided documentation.

### Request Example
{
  "example": ""
}

### Response
#### Success Response (200)
- No response fields are specified in the provided documentation.

#### Response Example
{
  "example": ""
}
```

--------------------------------

### Configure K3s Registries.yaml for Private Repository

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-virtual-appliance-in-air-gap-environment

This example shows the structure of the `registries.yaml` file used by K3s to configure private image registries. It specifies mirrors, authentication credentials, and TLS settings for the private repository. Replace placeholders like `<private registry URL>`, `xxx`, and file paths as needed.

```yaml
mirrors:
  docker.io:
    endpoint:
      - "<private registry URL>"
configs:
  "<private registry URL>":
    auth:
      username: xxx # this is the registry username
      password: xxx # this is the registry password
    tls: # if needed
      cert_file: # path to the cert file used in the registry
      key_file: # path to the key file used in the registry
      ca_file: # path to the ca file used in the registry
```

--------------------------------

### GET /v0/event_mappings/{id}

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory

Gets a single record from the event_mappings table.

```APIDOC
## GET /v0/event_mappings/{id}

### Description
Gets a single record in event_mappings table.

### Method
GET

### Endpoint
/v0/event_mappings/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - Event Mapping ID

### Request Body
No request body is specified in the provided documentation.

### Request Example
{
  "example": ""
}

### Response
#### Success Response (200)
- No response fields are specified in the provided documentation.

#### Response Example
{
  "example": ""
}
```

--------------------------------

### GET /v0/qid_records/{id}

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory

Gets a single record from the qid_records table.

```APIDOC
## GET /v0/qid_records/{id}

### Description
Gets a single record in qid_records table.

### Method
GET

### Endpoint
/v0/qid_records/{id}

### Parameters
#### Path Parameters
- **id** (string) - Required - QID Record ID

### Request Body
No request body is specified in the provided documentation.

### Request Example
{
  "example": ""
}

### Response
#### Success Response (200)
- No response fields are specified in the provided documentation.

#### Response Example
{
  "example": ""
}
```

--------------------------------

### Generic API Endpoint Examples

Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=widgets-creating-from-generic-api-data-source

Examples of API endpoints that can be used with the Generic API data source for dashboard widgets.

```APIDOC
## Generic API Endpoints

### Description
This section lists example API endpoints that can be configured when using the 'Generic API' data source for creating dashboard widgets.

### Method
GET

### Endpoint
These are examples of paths for generic API queries. The actual method might vary based on the API.

### Examples
* `/app/qproxy/proxy/api/asset_model/assets`
* `/app/qproxy/proxy/api/health_data/top_rules`
* `/app/qproxy/proxy/api/config/deployment/hosts`
* `/app/qproxy/proxy/api/config/event_sources/log_source_management/log_sources`
```
Tokens:
Raw