QRadar: How to use custom properties to locate asset changes

After you learned the history of the asset, you can use the Log Activity User Interface to search for details on how the asset was created or updated. To search for the asset, use this procedure.

1. Click Log Activity tab.
2. Click Add Filter.
3. Select Parameter: Log Source indexed > Operator: Equals > Log Source: Asset Profiler-2::
4. Click Add Filter to add to Current Filters.
5. In QRadar 7.3.x, click Search to display the results. In QRadar 7.2.x, click Filter to display search results.
6. Select Parameter: AssetID (custom) > Operator: Equals any of > Value: AssetId number > click (+) > Add Filter.
7. From the View: drop-down menu, choose a time interval to search for these events.

Next, you need to dig into details. The sample shows the highlighted values.

Jun 14 10:16:49 127.0.0.1 [com.q1labs.assetprofile.changelistener.impl.audit.AuditChangeListenerThread] com.q1labs.assetprofile.changelistener.impl.audit.AuditChangeListener: [INFO] LEEF:1.4|QRadar|AssetProfiler|7.0|IPADDRESS_UPDATED|assetId=1007 domainId=0 action=UPDATED id=1005 isuservalueNew=false interfaceIdNew=1005 interfaceIdOld=1005 ipv4addressNew=192.168.0.30 ipv4addressOld=192.168.0.30 ipaddressNew=192.168.0.30 netIdNew=23 ipVersion=IPV4 causedBy=HOST_PROFILER:QRadar731.ibm.com (192.168.0.30) auditDate=1528985806610

In the example, the Asset Profiler made the update on June 14, 2018 10:16:49 local time, but if you convert the auditDate (1528985806610) to human readable form, you get June 14, 2018 10:16:46.610 AM GMT-04:00 DST. Notice the time difference. In this case the Asset Profiler was busy and fell a little behind, it took about 3 seconds for the update to be processed.

Now you know when the update occurred and what caused it

If you have an update from Identity, then you need to find the event that caused the update. You'll need to do a log activity search for the event. Create a search with the following criteria:

• Time period of search should be centered around the auditDate time.Be mindful of the time zones (GMT).
• Filter according to what updates were giving you. The updates could be Hostname created, interface created, IP address created.
• filter for Identity IP, Identity MAC address or Identity Hostname/Identity NetBios based on the asset details.
• add Has Identity = TRUE. If the search shows that 6 events came in with the same NetBios name. Hence the asset has all the different MAC addresses.

The next thing we need is to look for the updates to the Asset Database, which created this mapping. This could have happened a long time ago, but maybe it is happening now. If so, we need to perform a search:

1. Log into the QRadar Console.
2. Click Log Activity tab.
3. Click Add Filter from the menu bar.
4. Select Log Source [Indexed] > Operator: Equals > "Asset Profiler-2 :: "
5. Click Add Filter.
6. From the menu bar, click Add Filter.
7. Select Payload Contains > "is" > add in the text box, the name of the system.
8. Click Add Filter.
9. From the View drop-down, select Last 3 days.
10. If there are events reported.
    1. Click Log Activity tab.
    2. Click Actions > Click Export to XML > Click Full Export (All Columns).

Note: If there are no events, try a longer time period.

If you cannot find any events then:

1. Click Assets tab.
2. Select the Asset you need to investigate.
3. Click Actions > Delete Asset.
4. If the asset returns with a questionable value, then re-run the search above to find when it was created.

From that export, we can see that the hostname was updated. The event is identified as:

• "Event Name": "Hostname Created"
• "Low Level Category": "Asset Hostname Created"
• "Source IP": "127.0.0.1"
• "Destination IP": "127.0.0.1"
• Looking at the event detail, it has:
• "QID": "68750002"
• In the payload, we should see something like hostnameNew=<HOSTNAME>.

First, find the Asset profile event we are interested in again in a Specific Interval search. This is to ensure we are looking at the right interval.

1. Log into the QRadar Console.
2. Click Log Activity tab.
3. Click Search > New Search.
4. Scroll down to Time Range > click the check box Specific Interval.
5. Pick a suitable "Start Time" and "End Time" around the Asset Profiler message discovered before. Try a 5 minute window centered on that time.
6. Scroll down to Search Parameters, add the following filters:
7. Select Log Source [Indexed] > Equals > Asset Profiler-2
8. Click Add Filter to add to Current Filters.
9. Return to Search Parameters.
10. Select Parameter: Payload Contains > Operator: "is" and the name of the system.
11. Click Add Filter to add to the Current Filters.
12. Search for results.
    1. In QRadar 7.3.x Click Search to display search results.
    2. In QRadar 7.2.x Click Filter to display search results.
13. Ensure the Asset Profiler event found before is displayed.

Now that we are sure we are looking at the right time range, let's find the event which triggered the Asset Profiler update.

Using the previous search results:

1. From the menu bar, click Search > Edit Search.
2. Scroll down to Search Parameters.
3. Highlight Log Source is Asset Profiler-2 :: > click Remove Selected Filters.
4. Highlight "Payload Contains is <HOSTNAME> and click Remove Selected Filters.
5. Click Parameter: Has Identity [Indexed] > Operator: Equals > Value: True.
6. Click "Add Filter" to add to Current Filters.
7. Search for results.
   1. In QRadar 7.3.x Click Search to display search results.
   2. In QRadar 7.2.x Click Filter to display search results.

Note: If too many results are returned, you can add another filter in the search to include the hostname.
For example: Identity Net Bios Name > Equals any of > {your hostname}.

After we have that event (or events) in the results, export it as a "Full XML Export".

To do this:

1. Click Log Activity tab.
2. Click Actions > Export to XML > Full Export (All Columns).