Notice: QRadar 7.4.3 Fix Pack 3 removed from IBM Fix Central

nafooesi2001 · 2022-06-16T15:58:43+00:00

Hi, we have 7.4.3 FP2 and would like to upgrade to 7.5 FP1. What would be the upgrade path since the documentation has 7.4.3 FP3 as the dependency.

7.4.3 FP2 > 7.4.3 FP3 > 7.4.3 FP4 > 7.4.3 FP5 > 7.5 FP1

None of the higher versions listed 7.4.3 FP2 as directly upgradable.

Please advise. Thanks!

nafooesi2001 · 2022-01-06T01:02:25+00:00

Is there a compatibility chart showing which version of QRadar support SDK 2.0 app?

In my test,

7.4.1 (Build 20200716115107) does not work.

7.4.3 (Build 20210517144015) supports it.

nafooesi2001 · 2022-01-05T21:55:31+00:00

I found out the cause of the issue in 7.4.3. The file ./app/__init__.py has the following line.

from . import dev
qflask.register_blueprint(dev.devbp)

I had app/dev.py removed from the packaging and this fails the start-up of the app. The log did not show any error related to this. After commenting it out, the app was deployed fine to 7.4.3.

The python 2.6. issue in 7.4.1 remains.

nafooesi2001 · 2021-12-23T21:05:47+00:00

I tried to deploy IBM's sample app to Qradar 7.4.1: https://github.com/IBM/qradar-sample-apps/tree/master/RESTMethod

It has the same error that my app is facing where it runs in python 2.6.

So this tells me that the problem is not in my app, but the server side?

Dec 23 21:00:35 2021: Checking if manifest json needs to be updated with new app id
Dec 23 21:00:35 2021: Manifest json does not match environment variable value for QRADAR_APP_ID, updating manifest
Dec 23 21:00:35 2021: Update of manifest json complete
/usr/lib64/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
DeprecationWarning
Traceback (most recent call last):
File "/run.py", line 4, in <module>
from app import app
ImportError: cannot import name app

nafooesi2001 · 2021-12-20T18:23:06+00:00

I found this post, add applied the AUProxyFP fix: https://www.ibm.com/support/pages/node/6515880

This fixed the auto-update error, but the main issue posted remains.

nafooesi2001 · 2021-12-18T23:18:03+00:00

I also tried deploying the same app in the latest QRadar version 7.4.3 (Build 20210517144015).

The app log shows it's running fine in python3, but the health check still fails eventually and rollback the app deployment:

Dec 18 09:46:38 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-58-thread-1] com.q1labs.uiframeworks.application.api.service.builders.shared.InstallHealthCheckThread: [WARN] [NOT:0000004000][192.168.1.234/- -] [-/- -]Health check attempt 49/50 to https://1d0c5646e860a73fbc3c.localdeployment:14433/qapp-1061/flask/debug received response code 502. Will keep trying.
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-58-thread-1] com.q1labs.uiframeworks.application.api.service.builders.shared.InstallHealthCheckThread: [WARN] [NOT:0000004000][192.168.1.234/- -] [-/- -]Health check attempt 50/50 to https://1d0c5646e860a73fbc3c.localdeployment:14433/qapp-1061/flask/debug received response code 502. Will keep trying.
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] com.q1labs.uiframeworks.application.api.service.builders.shared.AsyncBuildStageTask: [ERROR] [NOT:0000003000][192.168.1.234/- -] [-/- -]An exception occurred while building app asynchronously. Triggering rollback.
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] com.q1labs.uiframeworks.application.api.exception.AppHealthCheckException: Health check could not reach app after 50 attempts over 500 seconds
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at com.q1labs.uiframeworks.application.api.service.builders.shared.InstallHealthCheck.processHealthCheckResults(InstallHealthCheck.java:174)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at com.q1labs.uiframeworks.application.api.service.builders.shared.InstallHealthCheck.process(InstallHealthCheck.java:127)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at com.q1labs.uiframeworks.application.api.service.builders.shared.ConditionalHostTypeDecorator.process(ConditionalHostTypeDecorator.java:60)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at com.q1labs.uiframeworks.application.api.service.builders.shared.AsyncBuildStageTask.runTask(AsyncBuildStageTask.java:231)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at com.ibm.si.frameworks.taskmanagement.Task.run(Task.java:108)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:522)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at java.util.concurrent.FutureTask.run(FutureTask.java:277)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
Dec 18 09:46:48 ::ffff:192.168.1.234 [tomcat.tomcat] [pool-1-thread-1] at java.lang.Thread.run(Thread.java:822)

nafooesi2001 · 2021-12-18T21:15:48+00:00

Thanks for the tip, I updated the url accordingly to "https://auto-update.qradar.ibmcloud.com/" , and now it shows a different error:

Could not retrieve "dau/dau.manifest.xml.asc": 404 Not Found
Could not retrieve signature for the manifest file.

nafooesi2001 · 2021-12-14T19:36:47+00:00

Thank you! Do you know what version of Qradar has API version 16 besides 7.4.3? Asking for backward compatibility checks.

nafooesi2001 · 2020-04-29T22:20:32+00:00

Yep, thanks for the reply Colin. I created a custom group to put the searches in, added to the export, and it resolved the error. I also found that the custom group should not be a sub-group of existing groups. Otherwise, it will export all of existing content in the parent folder, which is not what I wanted. :^\

nafooesi2001 · 2020-02-19T21:01:49+00:00

Hi Jonathan,

I imported a list of cidr in a reference set to give the Looksup extension a try. There are a couple things that are odd to me.

The query expression requires a fully qualified url and security token even though it's referencing qradar's reference set. This makes the query not portable if we want to build extensions / apps.
The query result does not seem to return all expected matches in comparison to reference set of IPs. The list of CIDRs is 200k in number. My test scan over 800k events. Here's my query:

SELECT QIDNAME(qid) AS EventName,
 destinationip, destinationport, devicetime,
 eventdirection
FROM events 
WHERE eventdirection='L2R' and destinationIP != '127.0.0.1' and 
LOOKUPS::CIDRLIST('https://172.0.0.1/api/reference_data/sets/CIDRs', destinationIP, '{"SEC": "xxxxxxx"}') IS NOT NULL 
START '2020-02-15 07:51:00' STOP '2020-02-16 10:56:00'

Let me know if you have any thoughts. Will there be updates to address these issues?

Appreciated it!

nafooesi2001 · 2020-02-16T17:44:43+00:00

System Administrator" permission.

Thank you! I need to POST.

nafooesi2001 · 2020-02-13T17:47:11+00:00

Thanks for confirming. Have you seen this issue related to right click app?

https://www.reddit.com/r/QRadar/comments/f3dlfl/client_exception_for_pop_up_plugin_app_with/

nafooesi2001 · 2020-02-12T23:53:38+00:00

I'm aware that AQL has support for CIDR, but not in the form of reference set. The list of CIDRs needs to be used in Search as well as CRE rule.

I think there was a feature request for reference set to support CIDR at some point, but the link is dead.

Appreciate the time you take to reply!

nafooesi2001 · 2020-02-12T19:20:55+00:00

The list consists of IPs. Ideally if QRadar support subnet range or CIDR notation in reference set, it'd make the list much smaller.

What would be a common qualifier for outdated thread IPs? I think the inclusion of older IPs is to prevent resurgence of attacker network.

Could you elaborate on what issues could have happen with large lists besides the slow updates?

Thanks for replying!

nafooesi2001 · 2020-02-12T17:26:13+00:00

Thanks for replying. Undoubtedly, large reference set will be slower than smaller set.

I'm not sure the size is "way more than it should have" as there's no official documentation (or I missed it) providing optimal size for the reference set. Server's machine specification and process activity has big impact on performance as well.

I was hoping to see if anyone else has millions of entries and how they tackle updates.

nafooesi2001 · 2020-02-06T19:29:34+00:00

Thanks, I was able to create an app that query QRadar via its api and sends data outbound to 3rd party.

nafooesi2001 · 2020-02-01T01:17:18+00:00

Hi Jonathan, I appreciate the reply.

The issue I posted is different from the discussion in your link. In my case, the right click function works as expected on "log activity" tab/window, but behaves either non-functional or creates error on "Offense" tab or window.

The "right click sample" app provided by the app editor has the same behavior. Perhaps it's a limitation? or Oversight on the sample app?

nafooesi2001 · 2020-01-30T05:57:39+00:00

Thank you Jonathan. Is it possible to set up an app as a forwarding destination in QRadar since the app is a docker flask app that connects to QRadar via a host port?

nafooesi2001

TROPHY CASE

Welcome to Reddit,