-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a QRadarDF #11
Comments
Interesting idea. I don't really have any experience with QRadar, and I'm not entirely sure how many people would use this. I will put this on the idea backlog, though, so as not to lose it. Integrating with other common SIEM/log management platforms sounds like a good idea. |
Yeah I plan to contribute this myself actually :) |
Oh, that'd be great! One thing I should mention up front, though, is that any PR with this will also need to supply automated tests, similar to what I've already set up for SplunkDF and ElasticDF (basically, run the search engine in a local docker instance, load known datasets and then search against those). The actual tests are pretty simple (you can copy the Splunk or Elastic ones), but the doing the magic to get QRadar working will probably take some effort. Still, I'd love to see this! |
Unfortunately QRadar can't run in a docker container. I could use MagicMock or a simple web server to mock the API requests though for tests. |
that's weird, since I think all deployments use Docker anyway. At least,
if I understood their blog post correctly.
…On Wed, Jun 17, 2020 at 8:30 AM Matthew Ouellette ***@***.***> wrote:
Unfortunately QRadar can't run in a docker container. I could use
MagicMock or a simple web server to mock the API requests though for tests.
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
<#11 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACFXQ7LAWVF75LYVEEHKCOTRXCZPLANCNFSM4N73DDCA>
.
|
Yeah QRadar uses docker to run the appframework and some services but overall QRadar is a massive beast to run and needs an entire VM and a lot of resources. The smallest you could get away with is maybe setting up QRadar community edition, then saving a snapshot and reverting to it each time to run tests. Another option is to use MagicMock or a simple web server to mock the API requests for tests. |
Is your feature request related to a problem? Please describe.
Would be nice to add QRadar as a DF source
Describe the solution you'd like
Simple QRadarDF that can take basic auth or an API token. Runs the search synchronously to get results.
Describe alternatives you've considered
N/A
Additional context
Constructors:
Search parameters:
The text was updated successfully, but these errors were encountered: