Solved

QRadar Integration - Rest API calls to a Netskope tenant though a proxy (with authentication on)

  • 3 August 2021
  • 1 reply
  • 54 views

Badge +6

Has anyone experienced any issue while trying to configure the QRadar Rest API plugin to communicate to a Netskope tenant though a Proxy that requires authentication?

Important Notes:

- The Rest API plugin configuration is set as follows: Use Proxy = Yes         

- As the the proxy requires authentication, the Proxy Username and Proxy Password fields are configured.

- The Rest API was successfully tested from the QRadar console command line using curl. 

It really looks like an issue with the Rest API plugin.

Your comments and experience on this topic much appreciated.

Thank you in advance.

icon

Best answer by jlabbe 9 August 2021, 19:24

View original

1 reply

Badge +6

Did a bit more research, found several conflicting configuration documents and then found the following  recommendations:

Customers need to use the provided DSM  and the Cloud Log Shipper, no direct communication between QRadar and the customer’s Netskope tenant.  The official configuration manual is available at the following URL:

Netskope Security Cloud DSM

https://exchange.xforce.ibmcloud.com/hub/extension/ff97aaadc10ed96b0e05d1a1f24af2f7

Reply