App for IBM QRadar - Release Notes


Version 2.3.0

This update must be made before July 31st 2024!

App Versions prior to 2.3.0 use APIs and Data Forwarder Schema versions that will be deactivated on July 31st 2024.
For complete information about API Deactivations see API and Schema Migration.

Before you upgrade to 2.3.0

  • QRadar versions 7.5.0 UP3+ are supported. The app will not install on older QRadar versions.
  • App was migrated to use Alerts v7 instead of Alerts v6. Some fields in the earlier versions have been renamed or removed from the new versions.
  • An additional permission is needed to close alerts (Background Tasks - jobs.status - READ).
  • API Key with an Access Level type Custom is used to poll Audit Logs (Audit Logs (org.audits) - READ). Note that once the update is done, three days of history of audit logs will be ingested so audit log duplicates may be expected.
  • If you are using the Data Forwarder to ingest events, you would need to:
    • Create a Data Forwarder Alert v2 Schema with a different AWS S3 Bucket prefix and enable it. Doing this first is necessary to not lose alerts.
    • Create a new Log Source that uses the new Data Forwarder and enable it
    • Disable the Alerts Forwarder using v1 Schema
    • Wait for the ingest of Alerts with v1 Schema to complete
    • Disable the old Log Source
    • Update the Carbon Black Cloud QRadar App
    • Verify that Alerts are ingested correctly

After you upgrade

  • If you are using the Data Forwarder Alerts Input
    • Reconfigure the AWS SQS queue to consume the Alert v2 schema data.(Note: There may be duplicate data for the period both forwarders were running)

New Features:

  • Transitioned exclusively to API Keys with an Access Level Type “Custom” for authentication, simplifying API Key configuration. In order to continue to poll Audit Logs, you need to add additional permission in your Custom Key (Audit Logs (org.audits) - READ).
  • App updated to support Alerts v7 API and Data Forwarder Alert Schema v2.
  • Improved alert polling algorithm now processes alerts in batches of 10,000, reducing memory usage and enhancing performance.
  • Right-click actions for searching observations by IP address and viewing alerts now redirect users to the “Investigate” tab that is using the Observations API, facilitating the migration process from the Enriched Events Search API.

Bug Fixes:

  • Resolved issue causing unintended retransmission of old messages, enhancing system logging reliability by preventing message duplication.
  • Enhanced logging functionality to provide clearer error messages for failed syslog message transmissions.
  • Improved file reading mechanism to ensure accurate processing of syslog messages.
  • Added pagination support for improved device retrieval efficiency.
  • Fixed issue: Devices Tab now shows all devices when search field is empty.
  • Upgraded packages to fix vulnerabilities.

Version 2.2.1

Before you upgrade to 2.2.1

  • QRadar versions 7.4.3 FP8+ and 7.5.0 UP3+ are supported. The app would not install on older QRadar versions.

Bug Fixes:

  • Fixed an issue where alerts and audit logs were sent with delay in setups with low volume of security events.
  • Fixed application crash due to out-of-memory problem under high load which prevents the app from forwarding alerts
  • Fixed application crash when the console or apphost were down for a long time in setups with high volumes of security events.
  • Updated app dependencies due to security vulnerabilities in the versions used.

Known Issues:

  • Support for Squid proxy server is broken for https proxying. Users are advised to either switch to http proxying or to a different proxy server.

Version 2.2.0

New Features:

  • Refresh of the user interface for configuration of the app
    • New design and validations.
    • When selecting Settings > Configuration requests are triggered to check the validity. If there is something wrong with the credentials, the Device API or Alerts API at the current moment, validation errors will be shown.
  • Update of admin privileges
    • Carbon Black Cloud > Settings > Configuration is hidden behind admin previlleges.
    • Everything else, including Devices Tab, is accessible without admin privileges.
  • Two new right-click actions Get Process Details and View Alert. This requires changes to the permissions on the custom API key. See What to do before Upgrade for details.
  • Use new Policy Service to pull policies. This requires changes to the permissions on the custom API key. See What to do before Upgrade for details.
  • Added Reset Configuration and Test Configuration functionalities.
  • Added Custom Event Collector IP input field under Settings > App Configuration to provide a way to configure Custom Event Collector.
  • Support for parsing additional fields for Watchlist Hits.
  • Upgrade of the Python SDK version.

Bug Fixes:

  • Fixes of the poll procedure.
  • Remove redundant logging of proxy error when proxy is not enabled.
  • Resending alerts when we have IO error.
  • Added validation of query parameters for right-click actions.
  • Upgrade few packages due to vulnerabilities.

Documentation Updates:

  • Because of the major rewrite of the UI and some functionalities, we created a copy of the documentation to preserve previous user guides for anyone that is still using previous versions. However we highly recommend upgrading to the latest version.

What to do before Upgrade:

  • Before you upgrade from 2.1.1 to 2.2.0 you need to go to Carbon Black UI and add two more permissions in your Custom Key:
    • Policies (org.policies) - READ
    • Events (org.search.events) - READ.

Version 2.1.1

  • New way of validating API key.
  • Upgrade of a few packages, which previous versions have reported vulnerabilities.

Version 2.1.0

Before you upgrade from 2.0.0 to 2.1.0

  • You need to go to Admin > Custom Event Properties search for Process GUID and delete all of the mapping manually.

New Features

  • Multi-tenancy
  • Ability to add custom Log Source Identifier
  • Ability to toggle Audit Logs on or off

UI Changes

  • Added Log Source Identifier input field under Settings > App Configuration
  • Added Audit Logs toggle under Settings > Data

Detailed information and screenshots are available in the Installation & User Guide > App Upgrade section.

Resolved Issues

  • The help tooltips on the Settings pages were displayed only on mouse-hover over the “?” icon.
  • A small number of Alerts were not ingested into QRadar due to an app issue.
  • “Product URL” under Settings > App Configuration was not handling trailing slash.
  • Watchlist Alerts cannot be enabled if Enterprise EDR is not active. Enterprise EDR is required for receiving Watchlist Alerts.

Version 2.0.0

New Features

  • Data Input - CB_ANALYTICS (Alerts)
  • Data Input - DEVICE_CONTROL (Alerts)
  • Data Input - WATCHLIST (Alerts)
  • Data Input - Data Forwarder (Alerts and Endpoint.Events)
  • Right-click action - Hash Ban

UI Changes

  • Admin menu renamed to Settings
  • System Overview menu renamed to Devices
  • Carbon Black Cloud App Configuration menu renamed to App Configuration
  • Admin > Proxy Settings menu moved to Settings > App Configuration
  • Admin > Misc Settings > Polling moved to Settings > Data

Detailed information and screenshots are available in the Installation & User Guide > App Upgrade section.

Known Issues

  • The Settings tab is bolded as active after Right-click action redirection from Log Activity > View Device when the active tab must be “Devices”. (fixed in v2.2.0)
  • After the app upgrade from v1, the old log source will not pick up the new data (alerts, audit logs). Instead, a new log source needs to be created - either manually or via auto-detection.
  • The help tooltips on the Settings pages are displayed only on mouse-hover over the “?” icon.
  • Filled in values cannot be changed back to empty for the app configuration properties (Product URL, Org Key, API ID, API Secret Key, Proxy URL, Proxy Username, Proxy Password) (Reset Configuration button is added in v.2.2.0)
  • Log Source Time is a datetime field that is mapped to different date formats depending on the type of alerts/events and the log source that is used. However, in some rare cases the datetime cannot be parsed correctly. Then, the time at which the event arrived at QRadar will be used. For example: device_timestamp = ‘2021-11-09 11:52:00 +0000 UTC’ cannot be parsed using the format yyyy-MM-dd HH:mm:ss.SSS +0000 'UTC' (missing milliseconds) while device_timestamp = ‘2021-11-09 11:52:00.1 +0000 UTC’ and device_timestamp = ‘2021-11-09 11:52:00.123 +0000 UTC’ are parsed correctly.

Version 1.0.0

  • Initial Release

Last modified on June 5, 2024