QRadar: DNS Analyzer app and DSM support for custom event properties

How to update a DSM with custom event property support

The standard DSM for any device can be updated by an administrative user through the DSM editor to add support for the URL and DNS Request Type custom event properties if they can determine the regex (regular expression) for domain data from logs for the targeted device.

Update procedures
For example, you can add URL custom event property support for Microsoft Windows DNS servers where Request Logging has been enabled. The following workflow describes how to add a custom event property to parse URLs for the Microsoft DNS Debug log source type:

1. Open the DSM Editor from the IBM QRadar admin page and choose the Microsoft DNS Debug log source type for editing.
2. In the Properties tab, click the plus sign icon (+) to add a custom property, choosing URL from the displayed list.
3. Click the new URL property added to the Properties tab to edit it.
4. Add the regex Question Name=(\S+) to the Expression input field and add “1” to the Capture Group field.
5. Click the OK button to confirm the edit and then click Save to update the DSM.
   
   Results
   The custom event property is created for the log source type. When you view the event details page in QRadar, you will see your custom property displayed in the user interface with the notation (custom). Anytime you see (custom) in the user interface it indicates that the data associated to the value is a custom property in QRadar.
   If the event payloads for the event source contain DNS Request Type information, a DNS Request Type custom event property may also be added for the event source.Not all event sources provide DNS Request Type information in the event payload, especially if the event does not originate from a DNS Server.  If no DNS Request Type information is available for the event, or the custom event property is not properly added for the event source, then the request type will display as 'UNKNOWN' in the DNS Analyzer app dashboard statistics.

Content packs that add URL Custom Properties

Content packs can contain custom properties, rules, searches, and other valuable information to extends the core capabilities of QRadar for administrators. A good practice for administrators is to review that your apps and content packs are updated as the content pack may contain important parsing updates or optimizations.

The following list includes applications or content extensions for QRadar that contain the URL custom event property.

A. When you install the IBM QRadar DNS Analyzer app, it adds a URL custom property for the following DSMs:

• ICS Bind DNS / InfoBlox DNS
• Apache Web Proxy
• Squid Web Proxy
• BlueCat Networks Adonis
• McAfee Web Gateway
• Microsoft DNS Debug

• ICS Bind DNS / InfoBlox DNS
• Microsoft DNS Debug
• BlueCat Networks Adonis

B. The following content packs can be downloaded and installed to add a URL custom event property for the following event sources if it does not already exist, such as on older versions of QRadar:

• Check Point
• Cisco IronPort
• McAfee ePolicy Orchestrator
• Fortinet FortiAnalyzer
• Palo Alto PA Series Firewall
• Symantec Endpoint Protection

C. Depending on the version, IBM QRadar may ship with a URL custom property in the following DSMs:

• Blue Coat SG Appliance
• Juniper Networks Secure Access VPN SSL
• Check Point
• Cisco IronPort
• FireEye
• Fortinet FortiGate Security Gateway
• McAfee ePolicy Orchestrator
• Microsoft Windows Defender ATP
• Palo Alto PA Series
• Pulse Secure Pulse Connect Secure
• Symantec Endpoint Protection

TIP: Enabling XForce URL rule tests may cause performance issues for the QRadar DNS Analyzer app and generate "performance degradation" notifications in QRadar. Administrators can avoid performance issues by reducing the number of unique of URLs being tested by the system. Each unique URL must be evaluated when contained within a rule test; however, not all data in the query string of the URL is valid. By removing unneeded URL parameters with your custom event property regular expression it can help reduce system load by parsing only the important security information from the URL. Administrators should evaluate the data and significance of the URLs being collected by the system and attempt to optimize them where appropriate.

For example, the URL contains a non-human readable query string for a document edit. Since this is not relevant security information, the URL can be truncated down to the domain, path, and document information in the custom event property.

Non-optimized URL: example.com/path/document?a=some_value,token=88r23182734sajd182weee71262ee
Optimized URL: example.com/path/document