Contents

• Custom Action Scripts
• Custom Configurations
• Remote Automation
• Resources

---

Custom Action Scripts

Short Message Service

sms.sh

Send text messages from QRadar ”Custom Actions” using Twilio API in a bash file.

Setup

• Create an account from http://www.twilio.com
• Retrieve Phone number, Id, and Token generated under your dashboard
• Apply Phone number, Id, and Token into script
• Call script into QRadar, see QRadar setup below

QRadar Setup

• Go to Admin tab and select Define Actions under Custom Actions
• Select Add from top menu options
• Provide the following:

* Name * Description * Interpreter: Bash * Upload SMS Bash/Curl script * Parameter Name * Fix Property Value

• Click Add
• Click Save

Custom Configurations

arielRightClick.properties

To add these entries into the ariel right-click menu, copy this file into /opt/qradar/conf and restart tomcat.

The following options are included:

• Bluecoat
• Cisco Talos
• DomainTools
• Google Cached View
• LOLBAS
• Maclookup
• Robtex
• SpeedGuide
• ThreatCrowd
• URLVoid
• Userstack
• VeriSign

ipcontext_menu.xml

To add these entries into the right-click menu, copy this file into /opt/qradar/conf and restart tomcat.

The following options are included:

• Nmap
• Ping
• Traceroute
• X-Force Exchange
• AbuseIPDB
• AlienVault OTX
• Censys
• Cisco Talos
• DNSlytics
• DShield
• Google Safe Browsing
• GreyNoise
• IPVoid
• MxToolBox Blacklist
• Project Honey Pot
• Robtex
• Shodan
• Spamhaus Reputation Checker
• ThreatCrowd
• ThreatMiner
• VirusTotal

network_hierarchy.json

This is a starter template for Network hierarchy with "Address-Methods" that contains Loopback addresses, Multicast, and Unicast via IPv4 and IPv6. It also has the default "Net-10-172-192" only. Always remember to add geo coordinates.

Remote Automation

qradarcheck.py

Gathers information and presents an HTML status report about your QRadar deployment.

Resources

Resources & Content by IBM

• QRadar
• QRadar 101
• Reddit

Unofficial Resources

• Jose Bravo Youtube Tutorials
• QRadar Insights Blog

Disclaimer

All content is without warranty of any kind. Use at your own risk. I assume no liability for the accuracy, correctness, completeness, usefulness, or any damages.

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies.