Overview

This is a guide to setup CentOS for IBM QRadar CE Integration with VMware Workstation and send logs to QRadar CE.

CentOS in this setup will act as a client that will be monitored by QRadar CE.

Prerequisites

Setup

Note: Before you start, make sure your QRadar CE VM is already running.

1. Open VMware Workstation and click Open a Virtual Machine

Open a Virtual Machine

or you can click File > Open… or use the shortcut Ctrl + O

Open a Virtual Machine

2. Select the QRadar CE ISO file and click Open

Select the QRadar CE ISO file

3. Name the VM and select the location to save the VM, then click Import

Name the VM and select the location to save the VM

4. Wait for the import to complete then click Edit virtual machine settings

Wait for the import to complete

5. Change the virtual machine settings as needed

In my setup, I changed the following settings:

  • Memory: 512 MB
  • Processors: 1
  • Network Adapter: NAT

Note: We don’t need that much memory and processors for this setup, because we will only use it as a dummy server/client. You can change the settings later if you need more memory and processors.

Change the memory from 6 GB to 512 MB (or as needed)

memory

Change the processors from 2 to 1 (or as needed)

processors

Change the network adapter from Bridged to NAT, then click OK

network adapter

So the final settings will be like this:

final settings

6. Power on the VM

Power on the VM

7. Wait for the VM to boot up and login with the root user and create a new password

Note: Don’t forget the password that you created, because you will need it later.

login with root user

8. Configure the network

Type nmtui to open the Network Manager Text User Interface

nmtui

  • Select Set system hostname and press Enter

set system hostname

  • Set the hostname, in my setup I set it to centos and press Enter

set hostname

  • Select OK and press Enter

select OK

  • Select Quit and press Enter

select Quit

  • type clear to clear the screen

  • type bash to refresh the bash shell, so the hostname will be updated

refresh bash shell

  • Check the connection by typing ping google.com and press Enter

ping google.com

  • Check the IP address by typing ip -br addr and press Enter

Note: Take note of the IP address, because you will need it later.

ip -br addr

In my case, the IP address is 192.168.211.128

9. SSH to the VM centos

You can use PuTTY , Windows Terminal , Windows Subsystem for Linux (WSL) , MobaXterm or any other SSH client you want.

In my case, I use Termius .

  • Set the details as needed

set the details

  • Type ssh root@<IP address> and press Enter
  • Type password that you created earlier and press Enter
  • In Termius you can connect to the VM using Quick Connect feature, so you don’t need to type the IP address and password every time you want to connect to the VM.

ssh root@<IP address>

  • Voila! You are now connected to the VM

connected to the VM

10. Install the required packages and dependencies

  • Type yum install audit and press Enter

yum install audit

  • Type y if prompted and press Enter

y

11. Configure the auditd service

  • Start the auditd service by typing service start auditd and press Enter
  • If you get a warning, just type systemctl daemon-reload and press Enter
  • Type service start auditd and press Enter again

service start auditd

  • Type chkconfig auditd on and press Enter to enable the auditd service

chkconfig auditd on

  • Type service auditd status and press Enter to check the status of the auditd service

service auditd status

  • If you encounter an error like this:

The service command supports only basic LSB actions (start, stop, restart, try-restart, reload, force-reload, status). For other actions, please try to use systemctl.

service auditd status error

  • Just type systemctl start auditd and press Enter to start the auditd service.

systemctl start auditd

12. Configure the audit rules

  • Type vi /etc/audisp/plugins.d/syslog.conf and press Enter to edit the syslog.conf file

vi /etc/audisp/plugins.d/syslog.conf

vi /etc/audisp/plugins.d/syslog.conf

  • Press i to enter the insert mode

  • Change the content of the syslog.conf file to this:

    • active = yes
    • direction = out
    • path = builtin_syslog
    • type = builtin
    • args = LOG_LOCAL6
    • format = string

  • So the final content of the syslog.conf file will be like this:

syslog.conf

  • Press Esc to exit the insert mode
  • Type :wq and press Enter to save and exit the file

13. Configure the rsyslog service

  • Type vi /etc/rsyslog.conf and press Enter to edit the rsyslog.conf file

vi /etc/rsyslog.conf

  • Press shift + G to go to the end of the file
  • Press O to enter the insert mode and add this line at the end of the file:
    • *.* @<IP_ADDRESS_QRADAR>:514
  • Check the IP address of the QRadar CE VM, in my case the IP address is 192.168.211.129

rsyslog.conf

  • Like this:

rsyslog.conf

  • Press Esc to exit the insert mode
  • Type :wq and press Enter to save and exit the file

14. Restart the auditd and rsyslog services

  • Type service auditd restart and press Enter to restart the auditd service

service auditd restart

  • Type systemctl restart rsyslog and press Enter to restart the rsyslog service

systemctl restart rsyslog

15. Open the QRadar CE Dashboard on your browser and add a filter

  • Open your browser and go to https://<IP_ADDRESS_QRADAR>
  • Login with the username admin and your password
  • Click Log Activity and click Add Filter

Log Activity

  • Add a filter with the following details:
    • Parameter: Source IP [Indexed]
    • Operator: Equals
    • Value: <IP_ADDRESS_CENTOS>, in my case the IP address is 192.168.211.128

Add Filter

  • Change the View to Real Time (streaming)

Change the View

16. Test the log with add user in the centos VM

  • Type useradd test and press Enter to add a new user

useradd test

  • If you get Unknown log event, you can restart the auditd and rsyslog services again
  • Type service auditd restart and press Enter to restart the auditd service
  • Type systemctl restart rsyslog and press Enter to restart the rsyslog service
  • Type useradd test and press Enter again to add a new user
  • Now you can see the activity log in the QRadar CE Dashboard
  • You can also see the log in the /var/log/audit/audit.log file in the centos VM

useradd test

  • Test deleting the user by typing userdel test and press Enter

userdel test

  • Now you can see the activity log in the QRadar CE Dashboard, notice that the Event Name is contains user deletion activity.

userdel test

  • You can try with other activities like usermod, userpasswd, usergroup, login and logout, change some configuration, etc.

other activity

17. Voila! You have successfully setup CentOS for IBM QRadar CE Integration with VMware Workstation

You can now explore the QRadar CE Dashboard and see the logs from your CentOS VM.

References