Generic firewall

Configuring event properties for generic firewall events

You must manually configure JSA to interpret the incoming generic firewall events.

1. Forward all firewall logs to JSA.

   For information about forwarding firewall logs from your generic firewall to JSA, see the vendor documentation for your firewall events.

2. Open the following file:

   /opt/ qradar /conf/genericFirewall.conf

   Make sure you copy this file to systems that host the Event Collector and the JSA console.

3. Restart the Tomcat server:

   service tomcat restart

   A message is displayed indicating that the Tomcat server is restarted.

4. Enable or disable regular expressions in your patterns by setting the regex_enabled property. By default, regular expressions are disabled.

   For example:

   regex_enabled=false

   When you set the regex_enabled property to false, the system generates regular expressions based on the tags you entered while you try to retrieve the corresponding data values from the logs.

   When you set the regex_enabled property to true, you can define custom regex to control patterns. These regex configurations are directly applied to the logs and the first captured group is returned. When you define custom regex patterns, you must adhere to regex rules, as defined by the Java programming language. For more information, see http://download.oracle.com/javase/tutorial/essential/regex/

   To integrate a generic firewall with JSA, make sure that you specify the classes directly instead of using the predefined classes. For example, the digit class (/\d/) becomes /[0-9]/. Rewrite the expression to use the primitive qualifiers (/?/,/*/ and /+/) rather than using numeric qualifiers.

5. Add the following lines to the genericFirewall.conf file:

   The following table provides examples of values that you can use for each pattern.

   Pattern	Value	Example
   accept pattern=<accept pattern>	Packet accepted	The following log message shows accept pattern=Packet accepted: Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
   deny_pattern=<deny pattern>	Packet denied	The following log message shows deny_pattern=Packet denied: Aug. 5, 2005 08:30:00 Packet denied. Source IP: <Source_IP_address> Source Port: 21 Destination IP: <Destination_IP_address> Destination Port: 21 Protocol: tcp
   source_ip_pattern=<source IP pattern>	from	The following log message shows source_ip_pattern=Source IP:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
   source_port_pattern=<source port pattern>	port	The following log message shows source_port_pattern=Source Port:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
   destination_ip_pattern=<destination IP pattern>	from	The following log message shows destination_ip_pattern=Destination IP.Aug. 5, 2005 08:30:00 Packet accepted. SourceIP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
   destination_port_pattern=<destination port pattern>	port	The following log message shows destination_port_pattern=Destination Port:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp
   protocol_pattern=<protocol pattern>	protocol	The following log message shows protocol_pattern=Protocol:Aug. 5, 2005 08:30:00 Packet accepted. Source IP: <Source_IP_address> Source Port: 80 Destination IP: <Destination_IP_address> Destination Port: 80 Protocol: tcp

   Tip:

   Patterns are case-insensitive and you can add multiple patterns. For multiple patterns, separate by using a # symbol.

6. Save and exit the file.

   You are now ready to configure the log source in JSA.

Syslog log source parameters for generic firewall

If JSA does not automatically detect the log source, add a generic firewall server log source on the JSA Console by using the Syslog protocol.

When using the Syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from generic firewall: