Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Generic firewall

The generic firewall DSM for JSA records all relevant events by using Syslog.

You must configure JSA to interpret the incoming generic firewall events, and manually create a log source.

Configuring event properties for generic firewall events

You must manually configure JSA to interpret the incoming generic firewall events.

  1. Forward all firewall logs to JSA.

    For information about forwarding firewall logs from your generic firewall to JSA, see the vendor documentation for your firewall events.

  2. Open the following file:

    /opt/ qradar /conf/genericFirewall.conf

    Make sure you copy this file to systems that host the Event Collector and the JSA console.

  3. Restart the Tomcat server:

    service tomcat restart

    A message is displayed indicating that the Tomcat server is restarted.

  4. Enable or disable regular expressions in your patterns by setting the regex_enabled property. By default, regular expressions are disabled.

    For example:

    regex_enabled=false

    When you set the regex_enabled property to false, the system generates regular expressions based on the tags you entered while you try to retrieve the corresponding data values from the logs.

    When you set the regex_enabled property to true, you can define custom regex to control patterns. These regex configurations are directly applied to the logs and the first captured group is returned. When you define custom regex patterns, you must adhere to regex rules, as defined by the Java programming language. For more information, see http://download.oracle.com/javase/tutorial/essential/regex/

    To integrate a generic firewall with JSA, make sure that you specify the classes directly instead of using the predefined classes. For example, the digit class (/\d/) becomes /[0-9]/. Rewrite the expression to use the primitive qualifiers (/?/,/*/ and /+/) rather than using numeric qualifiers.

  5. Add the following lines to the genericFirewall.conf file:

    The following table provides examples of values that you can use for each pattern.

    Pattern

    Value

    Example

    accept pattern=<accept pattern>

    Packet accepted

    The following log message shows accept pattern=Packet accepted:

    Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

    deny_pattern=<deny pattern>

    Packet denied

    The following log message shows deny_pattern=Packet denied:

    Aug. 5, 2005 08:30:00 Packet denied. Source IP: <Source_IP_address> Source Port: 21 Destination IP: <Destination_IP_address> Destination Port: 21 Protocol: tcp

    source_ip_pattern=<source IP pattern>

    from

    The following log message shows

    source_ip_pattern=Source IP:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

    source_port_pattern=<source port pattern>

    port

    The following log message shows

    source_port_pattern=Source Port:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

    destination_ip_pattern=<destination IP pattern>

    from

    The following log message shows

    destination_ip_pattern=Destination IP.Aug. 5, 2005 08:30:00 Packet accepted. SourceIP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

    destination_port_pattern=<destination port pattern>

    port

    The following log message shows

    destination_port_pattern=Destination Port:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

    protocol_pattern=<protocol pattern>

    protocol

    The following log message shows

    protocol_pattern=Protocol:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
    Tip:

    Patterns are case-insensitive and you can add multiple patterns. For multiple patterns, separate by using a # symbol.

  6. Save and exit the file.

    You are now ready to configure the log source in JSA.

Syslog log source parameters for generic firewall

If JSA does not automatically detect the log source, add a generic firewall server log source on the JSA Console by using the Syslog protocol.

When using the Syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from generic firewall:

Table 1: Syslog log source parameters for the generic firewall DSM

Parameter

Value

Log Source Name

Type a name for your log source.

Log Source Description

Type a description for the log source.

Log Source type

Configurable Firewall Filter

Protocol Configuration

Syslog

Log Source Identifier

Type the IP address or host name for the log source as an identifier for events from your generic Firewall appliance.