Juniper JSA Series Virtual Appliance is a network-based security solution that provides comprehensive visibility and threat detection across your entire infrastructure. It uses machine learning and advanced analytics to detect and respond to threats in real time, including zero-day attacks and insider threats. The JSA Series Virtual Appliance also offers a variety of features to help you manage your security infrastructure, including:
Juniper JSA Series Virtual Appliance is a network-based security solution that provides comprehensive visibility and threat detection across your entire infrastructure. It uses machine learning and advanced analytics to detect and respond to threats in real time, including zero-day attacks and insider threats. The JSA Series Virtual Appliance also offers a variety of features to help you manage your security infrastructure, including:
QRadar Assistant App Guide
Published
2021-05-25
RELEASE
7.4.2
Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
QRadar Assistant App Guide
7.4.2
Copyright © 2021 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
ii
Table of Contents
About This Guide | iv
1
QRadar Assistant App
QRadar Assistant App | 2
What's New in the QRadar Assistant App | 3
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Running the Assistant app in Oine Mode | 21
Known Issues | 23
iii
About This Guide
Use the this guide to manage your app and content extension inventory, view app and content
extension recommendaons and get links to useful informaon.
iv
1
CHAPTER
QRadar Assistant App
QRadar Assistant App | 2
What's New in the QRadar Assistant App | 3
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Running the Assistant app in Oine Mode | 21
Known Issues | 23
QRadar Assistant App
Use the QRadar Assistant app to manage your app and content extension inventory, view app and
content extension recommendaons, follow the QRadar Twier feed, and get links to useful
informaon.
TIP: Aer upgrading the QRadar Assistant app, you may need to clear your browser cache to see
the new Assistant app icon and applicaon content.
NOTE: Use Extensions Management rather than the QRadar Assistant app to manage extensions
that have dependencies.
The QRadar Assistant app consists of the following secons:
•Guide Center--The QRadar Assistant Guide Center is a central point that links to a wide collecon of
QRadar informaon resources. From the Guide Center, you can view tuning and use cases videos
that are recorded by QRadar experts, watch previously recorded open mic sessions, access a wide
variety of QRadar technical ps, view IBM Security Community informaon, and watch video
tutorials. provided by IBM Learning Academy.
•Featured Applicaons--Featured applicaons are the most recently recommended applicaons that
are featured by QRadar.
•Support--View Juniper Customer Support.
•Support Forum--View the latest QRadar related quesons from QRadar developerWorks forums.
•Applicaons page--Search, sort, and lter available apps by various categories. You can see a quick
view of the app, then expand to see the full descripon and download the app. See which apps have
updates available.
When you select an app to download, it appears in the download drawer.
Open the drawer to see a list of apps that are queued for download or installaon. You can place up
to ve apps in the download queue at one me. To keep the download drawer open, click the pin
icon.
From Version 2.3.0, you can also view the list of currently installed QRadar extensions and contents.
•Watson Integraon--On the Watson Integraon page, you can learn how the QRadar Advisor with
Watson works with QRadar to invesgate and respond to threats. You can review requirements for
2
your QRadar system to install and run the Advisor app. You can also download and install QRadar
Advisor with Watson directly from the Assistant app.
What's New in the QRadar Assistant App
IN THIS SECTION
Version 3.2.0 | 4
Version 3.1.1 | 4
Version 3.1.0 | 4
Version 3.0.2 | 4
Version 3.0.1 | 5
Version 3.0.0 | 5
Version 2.5.2 | 5
Version 2.5.1 | 5
Version 2.5.0 | 5
Version 2.4.0 | 6
Version 2.3.0 | 6
Version 2.2.1 | 6
Version 2.2.0 | 6
Version 2.1.0 | 7
Version 2.0.2 | 7
Version 2.0.1 | 7
Version 2.0.0 | 7
Version 1.1.5 | 8
Version 1.1.3 | 8
Version 1.1.0 | 8
Version 1.0.3 | 8
Version 1.0.2 | 8
Version 1.0.1 | 9
3
Learn about the new features in each QRadar Assistant app release.
Version 3.2.0
• Enhanced compability check for extension installaons with mulple QRadar version support.
• Bug x for displaying installed apps in Applicaon Manager.
• Improved performance for displaying installed extensions.
• Added an opon to enable administrators to install extensions with user’s access token.
Version 3.1.1
• Fixed an issue which prevented the Security Administrator from managing applicaons.
• Fixed an issue for app logging.
• Updated translaons for user interface strings.
Version 3.1.0
• Added a widget in Applicaon Manager to display current app memory usage.
• Added the ability to manage applicaons without Internet access.
• Added an introducon tab for “QRadar Analyst Workow.”
• Bug x for connecon error over intercepng proxy.
Version 3.0.2
• Bug x for displaying extensions in the Applicaon Manager.
4
Version 3.0.1
Added a widget in the Instance wizard to display app memory usage in the multenant environment.
Added the Start default instance checkbox in the mul-tenant environment.
Improved the user experience for conguring instances in the mul-tenant environment.
Bug x for user permission sengs.
Version 3.0.0
• Added support for QRadar (7.4.0 Fix Pack 1 or later) multenancy.
• Added mulple language support.
• Added new resource links.
• Enhanced Watson Readiness Check.
• Fixed SSL cercate issues.
Version 2.5.2
• Added the Update Available ribbon.
• Fixed SSL cercate issues.
Version 2.5.1
• Reduced memory requirement from 800MB to 600MB.
• Fixed an issue that caused incorrect QRadar version display.
Version 2.5.0
• Renamed the tab name Tuning App to Use Case Manager.
5
• Updated images, text and links in the Use Case Manager Tab.
Version 2.4.0
• Added a link to the QRadar documentaon on the hps://support.juniper.net/support/downloads/.
• Fixed an issue that caused installing extensions to fail.
Version 2.3.0
• In the Guide Center, removed the Tuning Videos secon and moved the contents to the Tech Tips
secon.
• In the Guide Center, added the IBM Learning Academy secon that provides video tutorials.
• Under the social networking secon in the Guide Center, added the IBM Security Community sub-
secon.
• In the Applicaons, added a new secon (Installed) that lists currently installed QRadar extensions
and contents.
Version 2.2.1
• Added addional Watson Readiness checks.
• Added an icon that links to the IBM Security Community.
Version 2.2.0
•Applicaons screen lter persists between screens.
• App is automacally available to all user roles when installed.
• Upgrade All buon now available to upgrade all apps.
• Fixed an issue with the proxy when installing apps.
6
• Performance improvements.
• Accessibility enhancements.
• Supportability for IE 11 Edge mode.
•Mulple defect xes.
Version 2.1.0
• Improved Watson Readiness checks.
Version 2.0.2
• Fixed an issue where proxy did not work with mulple user accounts.
Version 2.0.1
•Simplied prole conguraon for admin users.
Version 2.0.0
• Complete redesign of the user interface.
•Integraon of Watson Readiness app.
• Added QRadar learning resources to the Guide Center.
• Added feature to enable download of ve apps directly from within Assistant App.
•Addional Log Source matching.
7
Version 1.1.5
• Added Call Home feature.
• Enhanced user interface.
• Minor defect xes.
Version 1.1.3
• Added Call Home feature.
• Enhanced user interface.
• Minor defect xes.
Version 1.1.0
• Log source matching - extensions will be recommended based on discovered log sources.
• Added a Tuning Video to QRadar Help Center to assist with steps on tuning your QRadar system.
• Fixed a number of minor defects.
Version 1.0.3
• Added Proxy related features.
• Detect QRadar version and disable downloading of apps depending on installed version.
• Fixed user interface issues.
• Fixed an issue where no Internet access / no proxy setup would result in an installaon failure.
Version 1.0.2
• Enhanced usability.
8
Version 1.0.1
• Minor styling changes.
RELATED DOCUMENTATION
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Conguring the QRadar Assistant App
The QRadar Assistant app is included in QRadar installaons of version 7.3.1 and later. You can
download the app from the IBM Security App Exchange for those versions. An Admin user must
congure certain opons to enable the Assistant app in your QRadar environment.
1. Click the Assistant app icon.
TIP: In QRadar versions 7.3.0 and earlier, click QRadar Assistant.
2. If you are the Admin conguring the Assistant app for the rst me, complete the following steps:
a. Enter a valid authorized service token into the banner on the Assistant app page and click Save.
NOTE: The security prole for the token must be Admin.
b. Click Sengs, select the API Authencaons tab, and enter your X-Force Exchange API Key and
API Password.
NOTE: Validaon of the API key can take several seconds.
NOTE: Aer an Admin congures the authorized service token and API key and password,
other Admin users do not need to perform this conguraon. Non-Admin users can use the
9
Assistant app, but are not authorized to download and install apps. To allow non-Admin users
to install apps, they must congure the Assistant app with an authorized service token that is
provided by an Admin.
3. To congure a proxy server for communicaon with X-Force Exchange, click Sengs, select the
Proxy tab, and enter the following informaon for your proxy server:
• Protocol
• Address
• Port
• User name
• Password
4. Click Save, then close the Sengs window.
5. If you want to use the QRadar Phone Home Service, click Agree.
For more informaon about the Phone Home Service, see "Phone Home" on page 18.
RELATED DOCUMENTATION
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Managing Installed Extensions
You can use the Installed secon on the Applicaons page to view and manage currently installed
QRadar extensions and contents.
1. Click the Assistant app icon , and then click Applicaons.
TIP: In QRadar versions 7.3.0 and earlier, click QRadar Assistant.
2. In the Installed secon, click View All to view applicaons by Installed Extensions, Installed Content,
and Custom Applicaons.
3. Hover your cursor over an applicaon card, and then click Quick View to open the Details Summary
pane.
10
Field Descripon
Manage Indicates the current status of the extension or
content.
Details Indicates the brief descripon of the extension
or content.
Delete Click to remove the extension or content.
Stop If available, click to deacvate the associated
applicaons.
NOTE: This opon is only available to
extensions and custom applicaons.
Start If available, click to acvate the associated
applicaons.
NOTE: This opon is only available to
extensions and custom applicaons.
4. Click the list view icon to view apps in a list. In Opons, you can perform the following tasks.
a. For extensions, you can select to either delete, stop, or start the selected item.
b. For contents, you can select to delete the selected item.
RELATED DOCUMENTATION
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
11
Managing Multenant Apps
IN THIS SECTION
Multenant Apps | 12
Conguring QRadar for Creang Mulple Instances | 13
Creang an Instance | 13
Managing Instances | 14
QRadar Assistant app 3.0.0 supports multenant environments in QRadar 7.4.0 Fix Pack 1 or later.
With QRadar Assistant 3.0.0 or later, you can manage instance for these apps (such as QRadar User
Behavior Analycs, QRadar Pulse, QRadar Log Source Management App) in a multenant environment.
You can create mulple instances and associate one instance to a security prole. By assigning a domain
to dierent security proles, you can segregate the events and ows that from dierent instances. For
example, you install a multenant app "Hello App" in a mul-divisional organizaon and you want to
create some security proles such as "Green Oce", "Blue Oce" with dierent domains. Aer you
create the security proles, you create mulple instances like "Hello App-Green Oce" and "Hello App-
Blue Oce" in a single shared deployment.
Use security proles and user roles to manage privileges for large groups of users in your environment.
Security proles and user roles ensure that users have access to only the informaon that they are
authorized to see.
Multenant Apps
You can create mulple instances for a multenant app to segregate dierent users. However, not every
QRadar app is supports multenancy, or needs to have mulple instances. In most cases, you would
have only one instance (default instance) aer the extension is installed. The default instance is globally
viewable for all users; you can assign the permissions in the user role sengs in JSA 7.3.1 or later.
12
Conguring QRadar for Creang Mulple Instances
You must congure QRadar administrave sengs to create mulple instances.
You can only create mulple instances with the QRadar Assistant 3.0.0 and QRadar 7.4.0 Fix Pack 1 and
later.
1. Create a security prole that would be associated later for the instance.
2. Create domains and associated those with the security prole specied in "Step 1" on page 13.
3. Create a user role that can access this app.
4. Create a user and associate to the specic security prole and user role.
5. Deploy changes.
1. Create a security prole "Blue Oce."
2. Create a user role named "DevOps."
3. Create a user named "blue-dev" to be associate with the security prole "Blue Oce" and the user
role "DevOps."
4. Deploy changes.
5. Create a new instance for the user "blue-dev."
Creang an Instance
With Assistant 3.0.0 and later in a mul-tenant environment, Admin users can create instance from a
mul-tenanted app.
You must complete the steps described in "Conguring QRadar for creang mulple instances" on page
13. Only Admin users can create new instances.
Every extension instance must be associated with a security prole. If an instance requires an authorized
service token, the authorized service must be assigned with the same security prole.
The opon Create New Instance is not available in the following situaons.
• The extension does not support multenancy: The extension is not multenancy aware and the
opon Create New Instance is not available.
13
• The extension only allows one instance to be created: Apps like Pulse, Log Source Management App,
and Assistant that are for administrave purposes can only have one instance.
1. Click the Assistant app icon, and then click Applicaons.
2. Ensure you're in the List View in Applicaon Manager.
3. In the Installed Extensions secon, click the ellipsis icon in the Opons column of the extension for
which you want to create an instance, and then click Create New Instance.
4. In the Create New Instance window, follow the onscreen instrucons to specify the Security prole
and User role, and then click Conrm and Create. Aer the instance is created, you can expand the
table and see a new row for this instance.
NOTE: Regarding the Installed Extension table,
• The Total Memory column shows the overall storage space used for all instances on the
corresponding extension. You can expand each row of the extension table to see more
details.
• Each row of the instance table is a grouped result. If an installed extension has two or
more apps, it would sll show only one row in the instance table but the memory
consumpon is a summaon of all apps.
5. Deploy changes in QRadar administrator page if the user roles are newly added.
Managing Instances
You can restart, stop, or congure an extension instance.
Stopping an extension instance will force logging o all users of that instance.
1. Click the Assistant app icon, and then click Applicaons.
2. Select the extension name whose instance you want to manage, and click the ellipsis icon in the
Opons column of the extension you want to manage.
Field Descripon
Start All Instances Start a stopped instance.
14
(Connued)
Field Descripon
Stop All Instances Stop an acve instance.
Delete All Instances Remove the instance.
Create New Instance Create a new instance.
Check for Updates Navigate to Full view for extension informaon.
Uninstall Extension Navigate to Extension Management for
PREVIEWING and Uninstall procedure.
NOTE: You need to uninstall all non-admin
instances before uninstalling the extension.
3. Click the ellipsis icon in the Opons column of the instance you want to manage.
Field Descripon
Start Instance Start a stopped instance.
Stop Instance Stop a running instance.
Delete Instance Remove the instance.
Congure Instance This opon is only available to the instances
that has exported the conguraon endpoints.
Aer clicking this opon, a sliding panel would
be displayed with the conguraon page
embedded in an iframe. Admin users can use
the page to congure the instance associated
with a specic security prole.
15
(Connued)
Field Descripon
View as [Security Prole Name] This opon is only available for the instances
that are associated with a non-admin security
prole. Admin user can use this funcon to
override the permission temporarily and to see
all instances associated with the specied
security prole.
NOTE: You need to refresh the browser to see
the addional instances granted by the override
permission.
Hide This opon is only available aer View as
[Security Prole] is selected. Click Hide to
toggle the overriding permission of the Admin
user.
RELATED DOCUMENTATION
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Downloading Apps with the QRadar Assistant App
On the Applicaons page, you can download and install apps from the X-Force Exchange.
1. Use any of the following methods to nd apps:
16
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
-
1
-
2
-
3
-
4
-
5
-
6
-
7
-
8
-
9
-
10
-
11
-
12
-
13
-
14
-
15
-
16
-
17
-
18
-
19
-
20
-
21
-
22
-
23
-
24
-
25
-
26
-
27
-
28
Juniper JSA Series Virtual Appliance User guide
- Type
- User guide
Juniper JSA Series Virtual Appliance is a network-based security solution that provides comprehensive visibility and threat detection across your entire infrastructure. It uses machine learning and advanced analytics to detect and respond to threats in real time, including zero-day attacks and insider threats. The JSA Series Virtual Appliance also offers a variety of features to help you manage your security infrastructure, including:
Ask a question and I''ll find the answer in the document
Finding information in a document is now easier with AI
Related papers
-
Juniper JSA3800 User guide
-
-
-
Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - MANAGING VULNERABILITY ASSESSMENT V1 User manual
-
-
-
-
-
-
Other documents
-
Powerbeat POWERBEAT 1.0 User manual
-
IBM QRadar XGS 5200 Replacement Instructions Manual
-
Nortel AA1419042 Datasheet
-
Cisco Nexus Data Broker Configuration Guide
-
Watchguard Fireware XTM Web UI User guide
-
ESET Security Management Center 7.0 Owner's manual
-
Dell OpenManage Network Manager Owner's manual
-
-
-
