Configuring ISIM as a Log Source For Qradar

Simple steps on Configuring ISIM as a Log Source for Qradar:

 For configuring ISIM as a Log Source we have to create two log sources:
1. For Connecting to ISIM DB (All Transactions performed on ISIM)
2. For Getting the ISIM DB Audit Logs(Transactions Performed on the ISIM DB).


ISIM Based Event Configuration:

Network Related configurations:

1. Make sure the DB2 port is open to the Qradar Machine


Configurations on Qradar:

1. Create a Log source for ISIM in Qradar.
2. Provide the below values for the Log source.
Log source Name: (Provide a Name for the Log source)
Log Source Description: (Provide a Description of the Log source)
Log souce Type: Select the option IBM Security Identity Manager.
Protocol Type: IBM Security identity manager JDBC
Log Source Identifier: (Name of DB)@(ip/Hostname of the DB machine)
DataBase Type : DB2
Database Name : (Name of the ISIM DB)
IP or Hostname: (IP/Hostname of the Database)
Port : (Port of DB2)
User name : (Provide the user name for connecting to Qradar)
Password : (Provide the password for the Username used to connect to DB)
Confirm Password : (Provide the password for the Username used to connect to DB)
Table Name : ISIMDB.AUDIT_EVENT
Select List : *
Compare Field : TIMESTAMP
Start Date: (Provide a Start date for the Qradar to read the events from DB, format is yyyy-mm-dd hh:mm)
Polling Interval : 30
EPS Throttle : 1000
Enabled : Check the box
Credibility : 5
Target Event Collector : (Select the first option in the dropdown, Mostly only one option is available)
Coaliscing Events : Check th box
Store Event Payload : Check the box
Log Source Extension : Leave as it is
Extension Use Condition : Leave as it is

3. Save the Log source.

Configuring ISIM Audit Events in Qradar:

Network Based Configurations:
1. Make sure port 22 for ftp/SFTP is open for Qradar to fetch the audit log file.

ISIM DB Based Configurations:

1. Login to DB2 server and switch user to DB instance owner
2. Run below command to configure a path for audit logs
  db2audit configure datapath /data/itimdb/sqllib/security/auditdata/
3. Connect to DB
   db2 connect to isimdb
4. Create audit policy on the database with category ‘execute’ to pick SQL statements executed
   db2 create audit policy db_policy categories execute with data status both error type audit
db2 audit database using policy db_policy
 db2 commit
5. Restart db2audit utility
  db2audit stop
 db2audit start
6. Execute below command to flush out audit log
 db2audit flush
7. Extract the audit logs
db2audit archive database itimdb
8. Extract the logs to a readable format
 db2audit extract from files <filename generated in step 7>
9. Create a Cronjob for the steps from 6 to 8 to be executed every one hour for the audit log to be generated.

Qradar side configurations:

1. Log in to QRadar.
2. Click the Admin tab.
3. Click the Log Sources icon.
4. Click Add.
5. In the Log Source Name field, type a name for the log source.
6. In the Log Source Description field, type a description for the log source.
7. From the Log Source Type list, select IBM DB2.
8. From the Protocol Configuration list, select Log File.
9. Provide the values as below:
Log Source Identifier : (IP/ Hostname of the DB2 Machine)
Service Type : FTP/SCP
Remote IP or Hostname : (IP/Hostname of DB2 machine)
Remote Port : 22
Remote User : Username of the user to connect to the db2 machine
Remote Password : Password of the user for connecting to db2 machine
Confirm Password : Password of the user for connecting to db2 machine
SSH Key file : (Only if you are using sftp if not leave it blank)
Remote Directory : Path of the directory in db2 machine where the log file is present
Recursive : (Only if you are using sftp if not leave it blank)
FTP File Pattern : .*.log
FTP Transfer Mode : ASCII
Start time : 12:10
Recurrence : 1H
Run On Save : check the box
EPS Throttle : 100
Processor : From the list, select None.
Ignore Previously Processed File(s): Select this check box
Change Local Directory: Do not select the check box
Event Generator : From the Event Generator list, select LineByLine.

10. Click Save.

Decrypting the Password from the ITIM property files in JAVA

Decrypting the Password from the ITIM property files in JAVA.

Yes we can decrypt an encrypted password from the ISIM Property files like enRoleLDAPConnection.properties and enRoledatabase.properties file.
This can be very helpful when you are trying to connect to ISIM LDAP or DB in the java code from workflows using FESI Extension or custom Extension or even in ISIM Hooked Reports.

The by default com.ibm.itim.common.properties package Provided by IBM in the websphere Libraries contains a class called PropertiesManager

Create an object for this class and check for the options of methods it provides from it.
Use the method called getEncryptedProperty and get the decrypted password.

Confused....... and probably wondering why the heck do you need all the above information right.
Ok then to make it much easier see the below sample code for reference.


Sample Code for reference

//add the below line along with your import statements
import com.ibm.itim.common.properties.PropertiesManager;

public class my class{

public myldapconnection(){
//creates an object for the PropertiesManager class
PropertiesManager pm =PropertiesManager.gInstance();
String ldapserverpwd =pm.getEncryptedProperty("enrole.ldap.connection","java.naming.security.credentials");


Ok so in the above code enrole.ldap.connection is actually an property in the properties.properties file in the <ISIM Installed location>/data/ folder
In my code The Properties Manager is refering to the properties.properties file and searching for the property file to look into.

java.io.FileNotFoundException in the TDI while using JNDI Connector as a feed to ISIM

ITIM from TDI using the JNDI connector result in java.io.FileNotFoundException.

Even though the file is present and it is of the correct format and in the correct location, TDI throws a file not found exception.
and yes it might not be because your file is not being able to be detected by the TDI but there can be other factors that are causing it.

There are typically two reasons for this error:
1. The port number defined in the URL definition is incorrect.
2. The name parameter on the TDI connection form is incorrect. (This actually results in a different error seen during the evaluation of this issue.

If a Certificate is deployed or if a VIP is defined for an Identity Manager WAS cluster, the URL to access the Identity Manager may look like this:

https://<ITIM VIP Hostname>/itim/console/main

But, the actual port where the enrole application is listening is not the standard 9080 or 80.

The Provider URL on the jndi connector - connection tab needs to match the port defined for the enrole application.

To determine the correct url/port:

Review the WAS Server's systemOut.log where the ITIM application is running.
Search for the startup details. For example:

WSVR0221I: Application started: ITIM
TCPC0001I: TCP Channel TCP_2 is listening on host * (IPv4) port 9082.


Therefore, on the TDI jndi connection tab, the ITIM Url must contain the correct (IPv4) port. For example,

http://<ITIM VIP Hostname>:9082/enrole/dsml2_event_handler
which matches the port defined in the WAS/Enrole.ear for the TCP listening port.

and finally
Verify the $dn is correctly formed based on the Naming Context/Search Base. For example:

ret.value="uid="+work.getString("UID")+","+<ConnectorName>.getConnectorParam("jndiSearchBase");

Configuring SSL between IBM security Identity manager and IBM TDS

There are 4 main concepts in doing this configuration.

Before doing this configuration first have the SSL configured on the IBM TDS LDAP instance…..if you refer my previous post of enabling ssl in IBM TDS LDAP instance you will be able to configure SSL on the TDS LDAP Instance.

First …..

Add the TDS certificate to Websphere CA Certs:

1. Start the ikeyman utility. The utility (ikeyman.bat or ikeyman.sh) is in the WAS_HOME\bin.
2. From the Key Database File menu, select Open.
3. In the key database type, select JKS.
4. In the File Name field, type cacerts.
5. In the Location field, type WAS_HOME\java\jre\lib\security\.
6. In the Password Prompt window, type the password for the keystore in the Password and Confirm Password window. The default password is changeit.
7. Click OK.
8. Add the certificate you created for the LDAP server into this certificate store.
1. In the main window, in the Key database content area, select Signer Certificates from the list.
2. Click Add.
3. In the Certificate file name field, browse and locate the server certificate file that was created for the LDAP server, which is in Binary Der data. Verify that the appropriate directory is displayed in the Location field.
4. Click OK.
5. In the prompt, type a label for this certificate. For example, type LDAPCA.
6. Click OK.

Secondly…..

Enabling ISIM to Communicate with LDAP using SSL Communication..

1. Edit the enRoleLDAPConnection.properties file. This file is in the ISIM_HOME\data directory.
1. Set the port value on the java.naming.provider.url property to the SSL port number configured on directory server [LDAP]. For example,

java.naming.provider.url=ldaps://localhost:636

2. Set the value of the java.naming.security.protocol property to ssl. This setting directs the IBM Security Identity Manager Server to use SSL to communicate to LDAP.Alternately you can change the protocol in java.naming.provider.url from ldap to ldaps. For example,

java.naming.security.protocol=ssl

2. Save the changes.

Thirdly……

Defining Custom JVM Properties in WebSphere

1. Select Servers > Application Servers > server_name > Process Definition > Java Virtual Machine > Custom Properties > New.
2. Define the name of the javax properties that you changed by using the ikeyman key management tool. You can create your own certificate store location, for which you must define some additional properties.

javax.net.ssl.trustStore – WebSphere jre_install_dir\lib\security\cacerts

eg: C:\Program Files\WebSphere\AppServer\java\jre\lib\security\cacerts

javax.net.ssl.trustStorePassword – changeit

javax.net.ssl.trustStoreType -- jks

Fourthly …..

Running LDAP Upgrade….

1. Before running the ldapUpgrade utility, verify that enRoleLDAPConnections.properties, has java.naming.security.protocol set to ssl.
2. Edit ISIM_HOME\bin\ldapUpgrade.lax file.

Add this property, which is one line:

lax.nl.java.option.additional=-Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStore=/opt/IBM/WebSphere/AppServer/java/jre/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Djava.ext.dirs=/opt/IBM/WebSphere/AppServer/java/jre/lib/ext:/opt/IBM/WebSphere/AppServer/plugins:/opt/IBM/WebSphere/AppServer/lib:/opt/IBM/WebSphere/AppServer/lib/ext

For example, on the Windows operating system:

lax.nl.java.option.additional=-Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStore=C:\Progra~1\IBM\WebSphere\AppServer\java\jre\lib\security\cacerts -Djavax.net.ssl.trustStorePassword=changeit -Djava.ext.dirs= C:\Progra~1\IBM\WebSphere\AppServer\java\jre\lib\ext; C:\Progra~1\IBM\WebSphere\AppServer\plugins;
C:\Progra~1\IBM\WebSphere\AppServer\lib;
C:\Progra~1\IBM\WebSphere\AppServer\lib\ext

Note: On the UNIX systems, the delimiter for the list of directories in java.ext.dirs must be a colon. On the Windows systems, the delimiter for these directories must be a semi-colon. Also, on Windows systems, use 8.3 notation for the directory names as there can be no spaces in the list.

3. Test if this property is set correctly.
1. Copy the property into the ISIM_HOME\bin\ldapConfig.lax file.
2. Click Test on the ldapConfig screen. If the test returns a success message, the property is set correctly.

Note: Do not click Continue on the ldapConfig screen. Click Cancel to exit.

Now Restart the complete WebSphere including nodes, clusters and DMGR.
with this you configuration is complete….

Changing TIM's Case insensitivity to Case Sensitivity

By Default all the attributes of a person objectclass in TIM is setup in case insensitive.
Changing the case in TIM Identity data fields doesn't not work. To reproduce: Open an existing user, change a case of one or more letters in the name (cn), surname (sn), mail or postOfficeBox. Click submit.
After the request is completed check the values. They have not changed. Issues it is causing: If HR changes case in these values for an existing user, the HR feed tries to update these values every night and never suceeds.

Can you check in the TDS web admin tool to see if these attribute values are set to case insensitive? If they are, please try changing them to 'case sensitive' and test again.
Equality is currently set to caseIgnoreMatch. So is ordering and the substring. Shall we set all to caseExact or only the equality? What side effects does this introduce?
To be frank i am not sure of this.
i have done this change and the only difference i am seeing is that my search has also become case sensitive search

If you dont want this change then the alternative would be to change your details to something that is completely different and revert back the change to old one with the case sensitive format.
Confused --- don't be --see the below example.

Example:----
I have a cn called dummies i want it to be changed to DummieS
dummies change it to dummies1 and then change it to DummieS

How to speed up development and testing of ACIs

The product maintains an ACI cache for performance reasons. By default, the ACI cache is automatically refreshed every 10 minutes. The interval is controlled by the following property in enRole.properties:
###########################################################
## AccessControlList refreshInterval - minutes to wait
## before cached ACIs are checked for changes and reloaded.
###########################################################
enrole.accesscontrollist.refreshInterval=10

The result of this default setting in a development environment is that any time a change is made to an ACI as part of a development effort, it will take up to 10 minutes for the change to be effected. Often when multiple iterative changes are being made it's not at all clear what changes did or did not go into effect thus slowing down the development effort.

To eliminate this bottleneck, setting enrole.accesscontrollist.refreshInterval to 0 will mean that ACI changes will be effected immediately. A restart of the application is required after making this change.

Warning: Do not do this in a production environment as the performance benefit of having the ACI caching mechanism will be lost.

Modifying labels in ITIM UI

For Account/Service field labels modify the $ITIM_HOME/data/CustomLabels.properties file. Find the attribute whose label that needs to be modify/create.

Example: To change the label for the erUid attribute, from 'User Id' to 'Account ID', change the following line from:


erUid=User Id

To:

erUid=Account ID

For General UI labels modify the $ITIM_HOME/data/Labels.properties file. 

Example: To change the wording "Create Password" (on the Password Management screen), to "Have ITIM Create a Random Password" modify the line:


generatePassword=Create Password

To:

generatePassword=Have ITIM Create a Random Password

Check for existing ID's via the ITIM Identity Policies and increasing Max Search results from 1000 objects.

In the Default Identity Policy, the line following checks for ID's in All services and in the Recycle Bin:

IdentityPolicy.userIDExists(baseidentity, true, true);

The first boolean expression is for CheckAllServices, the second is for CheckRecycleBin.

Setting either of these values to false will disable ID checking in that area. When CheckAllServices is set to true, it will only create a new ID for that user on a service if no other user has that ID on any service.

To increase the Max Search Results, modify the "enrole.ui.maxSearchResults" line in the $ITIM_HOME/data/ui.properties file (shown below)

enrole.ui.maxSearchResults=1000

Linux red hat 6.4 Pre-requisities for installing any ibm product (IBM Db2, TDS, ISIM, ISAM-eb, ISAMESSO, TFIM, TSPM, Websphere)

For Linux red hat 6.4, ensure as a first task install the below 32 and 64 bit packages. This is irrespective of the product you are installing.

 

64 bit:

yum install compat-libstdc++-33-3.2.3-69.el6.x86_64

yum install compat-db-4.6.21-15.el6.x86_64

yum install libXp-1.0.0-15.1.el6.x86_64

yum install libXmu-1.1.1-2.el6.x86_64

yum install libXtst-1.2.1-2.el6.x86_64

yum install pam-1.1.1-13.el6.x86_64

yum install libXft-2.3.1-2.el6.x86_64

yum install gtk2-2.18.9-12.el6.x86_64

yum install gtk2-engines-2.18.4-5.el6.x86_64

 

32 bit:

yum install compat-libstdc++-33-3.2.3-69.el6.i686

yum install compat-db-4.6.21-15.el6.i686

yum install libXp-1.0.0-15.1.el6.i686

yum install libXmu-1.1.1-2.el6.i686

yum install libXtst-1.2.1-2.el6.i686

yum install pam-1.1.1-13.el6.i686

yum install libXft-2.3.1-2.el6.i686

yum install gtk2-2.18.9-12.el6.i686

yum install gtk2-engines-2.18.4-5.el6.i686

ADT Issue - Save Failed org/apache/xml/serialize/OutputFormat

This issue is one of the most common Issue faced after installing ADT (Adapter Development Tool).

Why the issue is caused:
Mismatch in the Version of IBM Java.
ADT uses 32x IBM Java where as the TDI installed is of 64x which uses 64x bit IBM Java.

Steps to Fix:
The best way is to copy the JRE folder from the TDI to the ADT install folder. That way the ADT works even if your ADT dev machine's TDI is 64-bit (though this means you have to get the 32-bit java from another TDI installation).
Place the jre folder in the ADT home directory.

Adding our own java custom extension in ITIM workflow

How to Add our own java custom extension in ITIM workflow:

There are different approaches for calling our own java methods or classes in ITIM Workflows.

One of those examples is the custom java extension in ITIM workflow.

There are three main steps to be done for adding an custom extension in ITIM workflows:

l   Creating the jar of the java code.

Step 1 : Write your code which you want to execute while executing the workflow in the below format.

1.The code format

package com.<Package name>;

import java.net.MalformedURLException;

import java.net.URL;

import java.rmi.RemoteException;

import java.util.List;

import java.util.Vector;

import org.apache.axis.AxisFault;

import com.ibm.itim.workflow.application.*;

import com.ibm.itim.workflow.model.*;

public class <classname> implements WorkflowApplication

{

       public <classname>()

       {

       }

       WorkflowExecutionContext ctx;

       public void setContext(WorkflowExecutionContext ctx)

       {

              this.ctx = ctx;

       }

       public ActivityResult success(String param)

       {

              System.out.println("Success"+param);

              return new ActivityResult();

       }

       public ActivityResult failure()

       {

              // Return with success, no message

              System.out.println("Failure");

              return new ActivityResult(ActivityResult.STATUS_ABORT, "Error message.");

       }

       public ActivityResult <Method name>(<Parameters required for your method>) {

             

             

              try {

                     <write you code here>

                     If it is successful then call then return the below success message.

                            return new ActivityResult(ActivityResult.SUCCESS);

                     If it is not successfully executed then return the below message.

                            return new ActivityResult(ActivityResult.WARNING, "<Your own custom message>", null);

                                  

              } catch (MalformedURLException e1) {

                     System.out.println("MalformedURLException : "+e1);

                     e1.printStackTrace();

                     return new ActivityResult(ActivityResult.WARNING, "MalformedURLException Error message.", null);

              } catch (AxisFault e2) {

                     System.out.println("AxisFault : "+e2);

                     e2.printStackTrace();

                     return new ActivityResult(ActivityResult.WARNING, "AxisFault Error message.",null);

              } catch (RemoteException e3) {

                     System.out.println("RemoteException : "+e3);

                     // TODO Auto-generated catch block

                     e3.printStackTrace();

                     return new ActivityResult(ActivityResult.WARNING, "RemoteException Error message.",null);

              }

       }

2.Now make a jar file of the above method without including the supporting jars while making the jar file.

3.Now the supporting jars which are required for executing your code should be added to the itim reference libraries

Step 2: Modifying the properties file in itim:

1.Add the java package and class reference in the scriptframework.properties file in the itim data folder in the below format.

ITIM.java.access.<extension name>=<Package name as well as classname>

Eg:- ITIM.java.access.AppExt=com.company.AppExtExample

Step 3: Modifying the extensions file in itim to include the methods:

1.Now modify the workflowextensions.xml file (i.e) add the below lines to the xml file.

   <ACTIVITY ACTIVITYID="<method name>" LIMIT="0">

               <IMPLEMENTATION_TYPE>

                          <APPLICATION

                                     CLASS_NAME="<Package name as well as classname>"

                                     METHOD_NAME="<method name>" />

               </IMPLEMENTATION_TYPE>

                        <PARAMETERS>

                                    <IN_PARAMETERS PARAM_ID="<name of parameter>" TYPE="<type of datatype>" />

                        </PARAMETERS>

            </ACTIVITY>

2.You need to do the above activity for each method you want to invoke in your java extension.

Eg:- if you have three methods you need to write the above lines three times with each method details in them the above lines are only for one method.

3.Now restart the Websphere including the ITIM application, appserver, nodes and dmgr.

4.After restarting go to the itim console and open any of the workflow and in the extension click on the available methods you should find your method in that options.

References:-

http://tivoli-iam-help.blogspot.in/2012/08/writing-java-extensions-in-itim.html

http://www.slideshare.net/51lecture/techimplementation-of-complex-itim-workflows

http://tech.ivkin.net/wiki/IBM_Tivoli_Identity_Manager_How_To