IBM Support

QRadar: Simple Network Management Protocol (SNMP) uses in QRadar

Question & Answer


Question

How is Simple Network Management Protocol (SNMP) used in QRadar?

Cause

QRadar can be configured to send SNMP traps to another system.

Answer

QRadar uses SNMP trap configuration for 3 different areas:

Event collection - Receiving SNMP events from other systems

The event collection service (ecs) on QRadar collector and processor can receive events from other systems through SNMP Protocol.
In order to collect SNMP data:
  1. By default, snmp port 162 is disabled on QRadar hosts. The following iptables and netstat commands returns no results: 
    [root@hostname ~]# iptables -nvL | grep 162
[root@hostname ~]# netstat -nlp | grep 162
[root@hostname ~]#
  2. A log source must be created. QRadar supports both SNMP V2 and V3 versions:
    SNMPv2 protocol configuration options
    SNMPv3 protocol configuration options
     
  3. A Full Deploy processed in order for port to be opened and listening.
    Note: a Full Deploy needs to be processed during a maintenance window.  
    [root@hostname ~]# iptables -nvL | grep 162
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:162
[root@hostname ~]# netstat -nlp | grep 162
udp        0      0 :::162                      :::*                                    30064/ecs

Custom Rules - Sending out SNMP messages as response actions from rules

In the Custom Rules window, SNMP is also used as part of a Rules response. The Custom Rule Engine (CRE) might send SNMP messages to other systems when some rule fires response based on its criteria.

  1. This functionality is not enabled by default and must be enabled through Admin > System Settings. 
  2. Under SNMP Settings section, change Disabled to version used: SNMPv2c or SNMPv3. 
  3. Specify Destination Host.
  4. Select Destination Port.
  5. For SNMPv2c, specify Community string.
  6. For SNMPv3, specify Username, Security Level, Authentication Protocol, Authentication Password, Privacy Protocol, and Privacy Password.
  7. Select Save.
  8. Optional: create a custom rule.
  9. A Full Deploy processed in order for port to be opened and listening.
    Note: a Full Deploy needs to be processed during a maintenance window. 
Result
After a rule is fired, you can check whether SNMP traps are sent by running tcpdump over port 162:
tcpdump -nnAs0 -i <management interface> port 162

Monitoring - Responding to SNMP queries about process and health

This SNMP feature allows remote SNMP polling from other system to query QRadar about its system health.

By default, port 8001 is used as 162 is used for event collection. 
Note: SNMP version 2 is supported.
  1. To enable this service, go to Admin > System Settings.
  2. Go to Embedded SNMP Daemon Settings.
  3. Change Enabled to Yes.
  4. Add to IP Access List the monitoring server.
  5. Update Daemon Port and Community String as needed.
  6. A Full Deploy processed in order for port to be opened and listening.
    Note: a Full Deploy needs to be processed during a maintenance window. 
Result
  1. To verify whether snmpd service is running, use commands netstat and iptables: 
    [root@hostname ~]# netstat -nlp | grep 8001
udp        0      0 0.0.0.0:8001                0.0.0.0:*                               26593/snmpd
[root@hostname ~]# iptables -nvL | grep 8001
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:8001
  2. Test with SNMP query: 
    snmpwalk -Os -c public -v 2c localhost:8001 iso.3.6.1.2.1.1.1
    Follow this guide for further troubleshooting:
    QRadar: Test if SNMP Daemon is correctly running on the QRadar appliance

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"TS011968779","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
27 June 2023

UID

ibm16998413

Page Feedback