### Verify Installed Packages Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages These commands verify the installation of specific packages by checking their version information. This is a general approach and can be adapted for any installed package. ```bash rsync --version ``` ```bash screen --version ``` ```bash snmpd --version ``` -------------------------------- ### Install createrepo Package (Bash) Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software Installs the 'createrepo' package using yum. This is a prerequisite for installing the standalone software in certain environments. It ensures that the necessary repository creation tools are available. ```bash sudo yum install -y createrepo ``` -------------------------------- ### Install container-selinux on RHEL 7 (Bash) Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software Installs the 'container-selinux' package on Red Hat Enterprise Linux 7. This step is required before installing the standalone software and involves enabling specific repositories. ```bash sudo subscription-manager repos --enable=rhel-7-server-extras-rpms &&\ sudo yum install container-selinux ``` -------------------------------- ### Install container-selinux on RHEL 8 (Bash) Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-installing-standalone-software Installs the 'container-selinux' package on Red Hat Enterprise Linux 8. This is a prerequisite for the standalone software installation and requires enabling the RHEL 8 appstream repository. ```bash sudo subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms &&\ sudo yum install container-selinux ``` -------------------------------- ### AQL Query with LIMIT, START, and STOP Clauses Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=explorer-building-search-queries This AQL query demonstrates the use of `LIMIT`, `START`, and `STOP` clauses to control the number of results returned and the time range for the query. It selects all fields from events, limits results to 20, and specifies a start and stop time. ```aql SELECT * FROM events LIMIT 20 START '2021-01-01 00:00' STOP '2021-01-01 01:00' ``` -------------------------------- ### Install Edge Gateway Software Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=iss-apps-only-standalone-software-in-air-gap-environment This command initiates the installation of the Edge Gateway software using the `manageAppHost` utility. It requires pairing information, the registry URL, and username for authentication, and configures the Edge Gateway to use the specified private registry. ```bash sudo manageAppHost install -p --registry --user ``` -------------------------------- ### Install Edge Gateway Standalone Software (Bash) Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-standalone-software Executes the Edge Gateway installation script. This command requires the actual version number to be specified in the filename `apphost-.run`, where `x.x.x` represents the version. ```bash sudo bash apphost-.run ``` -------------------------------- ### Sample Queries for Dummy Data Sources Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=connectors-stix-bundle These are example queries designed to retrieve data from dummy data source connections. They are based on sample data provided within the URLs and demonstrate filtering by IP address, network traffic, destination port, and user ID. These queries will only return results if they match the predefined sample data. ```generic [ ipv4-addr:value != '127.0.0.1' ] [ network-traffic:src_ref.value != '127.0.0.1' ] [ network-traffic:dst_port = 443 ] [ user-account:user_id = 'test' ] ``` -------------------------------- ### Verify Edge Gateway Version Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=gateway-upgrading-edge This command checks the current installed version of the Edge Gateway. It is a prerequisite before starting the upgrade process. No specific input is required, and the output is the version string. ```bash manageAppHost --version ``` -------------------------------- ### Install K3s Airgap Images Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-virtual-appliance-in-air-gap-environment This procedure involves creating a directory for K3s agent images and copying the downloaded `k3s-airgap-images` tar file into it. This prepares K3s to run in an air-gapped environment by providing necessary images locally. Replace `` with the actual file name. ```bash sudo mkdir -p /var/lib/rancher/k3s/agent/images/ sudo cp /var/lib/rancher/k3s/agent/images/ ``` -------------------------------- ### Example: QRadar Local CA Certificate Chain Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=ccq-determining-whether-your-certificate-is-internally-signed-custom-signed This output indicates that the QRadar console is using an internally signed certificate signed by the QRadar Root CA and QRadar Local CA. This output guides the user to follow specific steps for downloading and adding certificates. ```text CONNECTED(00000003) depth=2 CN = QRadar Local Root CA verify return:1 depth=1 CN = QRadar Local CA verify return:1 depth=0 CN = qradar-742-console.example.ibm.com verify return:1 — Certificate chain 0 s:/CN=qradar-742-console.example.ibm.com i:/CN=QRadar Local CA ``` -------------------------------- ### AQL Query Example for IBM QRadar Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=explorer-building-search-queries This AQL query retrieves specific event details such as magnitude, source IP, destination IP, destination port, event name, log source, category name, and start time. It filters events based on text search for '127.0.0.1' and limits the results to 1000, looking back over the last 2 hours. ```aql SELECT magnitude, sourceip, destinationip, destinationport, QIDNAME(qid) AS 'Event Name', LOGSOURCENAME(logsourceid) AS 'Log Source', CONCAT(CATEGORYNAME(highLevelCategory), '.', CATEGORYNAME(category)) AS 'Category Name', DATEFORMAT(startTime, 'MMM dd hh:mm a') AS 'Start Time' FROM events WHERE TEXT SEARCH '127.0.0.1' LIMIT 1000 LAST 2 HOURS ``` -------------------------------- ### Recreate Edge Gateway Instance with manageAppHost install Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-pairing-security-qradar-suite-software-account-edge-gateway This command is used to recreate an Edge Gateway instance if the pairing information is regenerated for an active gateway. It requires the `manageAppHost install` command to be executed. ```bash manageAppHost install ``` -------------------------------- ### Create Local Yum Repository Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages This command executes a run file to create or update a local Yum repository named 'apphost_optional'. Ensure you replace '' with the appropriate version number. ```bash sudo bash ./apphost-ova-optional-packages-repo-.run ``` -------------------------------- ### Install Package on RHEL 8 Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=application-installing-optional-packages This command installs the 'net-snmp' package on a Red Hat Enterprise Linux 8 system. It explicitly disables all other repositories and enables only 'apphost_optional' to ensure the package is installed from the local repository. ```bash sudo yum --disablerepo="*" --enablerepo="apphost_optional" install net-snmp ``` -------------------------------- ### GET /v0/event_mappings Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory Gets multiple records from the event_mappings table. ```APIDOC ## GET /v0/event_mappings ### Description Gets multiple records in event_mappings table. ### Method GET ### Endpoint /v0/event_mappings ### Parameters No parameters are specified in the provided documentation. ### Request Body No request body is specified in the provided documentation. ### Request Example { "example": "" } ### Response #### Success Response (200) - No response fields are specified in the provided documentation. #### Response Example { "example": "" } ``` -------------------------------- ### GET /v0/qid_records Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory Gets multiple records from the qid_records table. ```APIDOC ## GET /v0/qid_records ### Description Gets multiple records in qid_records table. ### Method GET ### Endpoint /v0/qid_records ### Parameters No parameters are specified in the provided documentation. ### Request Body No request body is specified in the provided documentation. ### Request Example { "example": "" } ### Response #### Success Response (200) - No response fields are specified in the provided documentation. #### Response Example { "example": "" } ``` -------------------------------- ### Configure K3s Registries.yaml for Private Repository Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=installation-virtual-appliance-in-air-gap-environment This example shows the structure of the `registries.yaml` file used by K3s to configure private image registries. It specifies mirrors, authentication credentials, and TLS settings for the private repository. Replace placeholders like ``, `xxx`, and file paths as needed. ```yaml mirrors: docker.io: endpoint: - "" configs: "": auth: username: xxx # this is the registry username password: xxx # this is the registry password tls: # if needed cert_file: # path to the cert file used in the registry key_file: # path to the key file used in the registry ca_file: # path to the ca file used in the registry ``` -------------------------------- ### GET /v0/event_mappings/{id} Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory Gets a single record from the event_mappings table. ```APIDOC ## GET /v0/event_mappings/{id} ### Description Gets a single record in event_mappings table. ### Method GET ### Endpoint /v0/event_mappings/{id} ### Parameters #### Path Parameters - **id** (string) - Required - Event Mapping ID ### Request Body No request body is specified in the provided documentation. ### Request Example { "example": "" } ### Response #### Success Response (200) - No response fields are specified in the provided documentation. #### Response Example { "example": "" } ``` -------------------------------- ### GET /v0/qid_records/{id} Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=administering-audit-inventory Gets a single record from the qid_records table. ```APIDOC ## GET /v0/qid_records/{id} ### Description Gets a single record in qid_records table. ### Method GET ### Endpoint /v0/qid_records/{id} ### Parameters #### Path Parameters - **id** (string) - Required - QID Record ID ### Request Body No request body is specified in the provided documentation. ### Request Example { "example": "" } ### Response #### Success Response (200) - No response fields are specified in the provided documentation. #### Response Example { "example": "" } ``` -------------------------------- ### Generic API Endpoint Examples Source: https://www.ibm.com/docs/en/cloud-pak-sec-aas/index_topic=widgets-creating-from-generic-api-data-source Examples of API endpoints that can be used with the Generic API data source for dashboard widgets. ```APIDOC ## Generic API Endpoints ### Description This section lists example API endpoints that can be configured when using the 'Generic API' data source for creating dashboard widgets. ### Method GET ### Endpoint These are examples of paths for generic API queries. The actual method might vary based on the API. ### Examples * `/app/qproxy/proxy/api/asset_model/assets` * `/app/qproxy/proxy/api/health_data/top_rules` * `/app/qproxy/proxy/api/config/deployment/hosts` * `/app/qproxy/proxy/api/config/event_sources/log_source_management/log_sources` ```