Juniper JSA3800 User guide

JSA3800
Juniper
Brand
Juniper
Model
JSA3800
Type
User guide

This manual is also suitable for

QRadar Assistant App Guide
Published
2021-05-25
RELEASE
7.4.2
Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
QRadar Assistant App Guide
7.4.2
Copyright © 2021 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
ii
Table of Contents
About This Guide | iv
1
QRadar Assistant App
QRadar Assistant App | 2
What's New in the QRadar Assistant App | 3
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Running the Assistant app in Oine Mode | 21
Known Issues | 23
iii
About This Guide
Use the this guide to manage your app and content extension inventory, view app and content
extension recommendaons and get links to useful informaon.
iv
1
CHAPTER
QRadar Assistant App
QRadar Assistant App | 2
What's New in the QRadar Assistant App | 3
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Running the Assistant app in Oine Mode | 21
Known Issues | 23
QRadar Assistant App
Use the QRadar Assistant app to manage your app and content extension inventory, view app and
content extension recommendaons, follow the QRadar Twier feed, and get links to useful
informaon.
TIP: Aer upgrading the QRadar Assistant app, you may need to clear your browser cache to see
the new Assistant app icon and applicaon content.
NOTE: Use Extensions Management rather than the QRadar Assistant app to manage extensions
that have dependencies.
The QRadar Assistant app consists of the following secons:
•Guide Center--The QRadar Assistant Guide Center is a central point that links to a wide collecon of
QRadar informaon resources. From the Guide Center, you can view tuning and use cases videos
that are recorded by QRadar experts, watch previously recorded open mic sessions, access a wide
variety of QRadar technical ps, view IBM Security Community informaon, and watch video
tutorials. provided by IBM Learning Academy.
•Featured Applicaons--Featured applicaons are the most recently recommended applicaons that
are featured by QRadar.
•Support--View Juniper Customer Support.
•Support Forum--View the latest QRadar related quesons from QRadar developerWorks forums.
•Applicaons page--Search, sort, and lter available apps by various categories. You can see a quick
view of the app, then expand to see the full descripon and download the app. See which apps have
updates available.
When you select an app to download, it appears in the download drawer.
Open the drawer to see a list of apps that are queued for download or installaon. You can place up
to ve apps in the download queue at one me. To keep the download drawer open, click the pin
icon.
From Version 2.3.0, you can also view the list of currently installed QRadar extensions and contents.
•Watson Integraon--On the Watson Integraon page, you can learn how the QRadar Advisor with
Watson works with QRadar to invesgate and respond to threats. You can review requirements for
2
your QRadar system to install and run the Advisor app. You can also download and install QRadar
Advisor with Watson directly from the Assistant app.
What's New in the QRadar Assistant App
IN THIS SECTION
Version 3.2.0 | 4
Version 3.1.1 | 4
Version 3.1.0 | 4
Version 3.0.2 | 4
Version 3.0.1 | 5
Version 3.0.0 | 5
Version 2.5.2 | 5
Version 2.5.1 | 5
Version 2.5.0 | 5
Version 2.4.0 | 6
Version 2.3.0 | 6
Version 2.2.1 | 6
Version 2.2.0 | 6
Version 2.1.0 | 7
Version 2.0.2 | 7
Version 2.0.1 | 7
Version 2.0.0 | 7
Version 1.1.5 | 8
Version 1.1.3 | 8
Version 1.1.0 | 8
Version 1.0.3 | 8
Version 1.0.2 | 8
Version 1.0.1 | 9
3
Learn about the new features in each QRadar Assistant app release.
Version 3.2.0
• Enhanced compability check for extension installaons with mulple QRadar version support.
• Bug x for displaying installed apps in Applicaon Manager.
• Improved performance for displaying installed extensions.
• Added an opon to enable administrators to install extensions with user’s access token.
Version 3.1.1
• Fixed an issue which prevented the Security Administrator from managing applicaons.
• Fixed an issue for app logging.
• Updated translaons for user interface strings.
Version 3.1.0
• Added a widget in Applicaon Manager to display current app memory usage.
• Added the ability to manage applicaons without Internet access.
• Added an introducon tab for “QRadar Analyst Workow.”
• Bug x for connecon error over intercepng proxy.
Version 3.0.2
• Bug x for displaying extensions in the Applicaon Manager.
4
Version 3.0.1
Added a widget in the Instance wizard to display app memory usage in the multenant environment.
Added the Start default instance checkbox in the mul-tenant environment.
Improved the user experience for conguring instances in the mul-tenant environment.
Bug x for user permission sengs.
Version 3.0.0
• Added support for QRadar (7.4.0 Fix Pack 1 or later) multenancy.
• Added mulple language support.
• Added new resource links.
• Enhanced Watson Readiness Check.
• Fixed SSL cercate issues.
Version 2.5.2
• Added the Update Available ribbon.
• Fixed SSL cercate issues.
Version 2.5.1
• Reduced memory requirement from 800MB to 600MB.
• Fixed an issue that caused incorrect QRadar version display.
Version 2.5.0
• Renamed the tab name Tuning App to Use Case Manager.
5
• Updated images, text and links in the Use Case Manager Tab.
Version 2.4.0
• Added a link to the QRadar documentaon on the hps://support.juniper.net/support/downloads/.
• Fixed an issue that caused installing extensions to fail.
Version 2.3.0
• In the Guide Center, removed the Tuning Videos secon and moved the contents to the Tech Tips
secon.
• In the Guide Center, added the IBM Learning Academy secon that provides video tutorials.
• Under the social networking secon in the Guide Center, added the IBM Security Community sub-
secon.
• In the Applicaons, added a new secon (Installed) that lists currently installed QRadar extensions
and contents.
Version 2.2.1
• Added addional Watson Readiness checks.
• Added an icon that links to the IBM Security Community.
Version 2.2.0
•Applicaons screen lter persists between screens.
• App is automacally available to all user roles when installed.
• Upgrade All buon now available to upgrade all apps.
• Fixed an issue with the proxy when installing apps.
6
• Performance improvements.
• Accessibility enhancements.
• Supportability for IE 11 Edge mode.
•Mulple defect xes.
Version 2.1.0
• Improved Watson Readiness checks.
Version 2.0.2
• Fixed an issue where proxy did not work with mulple user accounts.
Version 2.0.1
•Simplied prole conguraon for admin users.
Version 2.0.0
• Complete redesign of the user interface.
•Integraon of Watson Readiness app.
• Added QRadar learning resources to the Guide Center.
• Added feature to enable download of ve apps directly from within Assistant App.
•Addional Log Source matching.
7
Version 1.1.5
• Added Call Home feature.
• Enhanced user interface.
• Minor defect xes.
Version 1.1.3
• Added Call Home feature.
• Enhanced user interface.
• Minor defect xes.
Version 1.1.0
• Log source matching - extensions will be recommended based on discovered log sources.
• Added a Tuning Video to QRadar Help Center to assist with steps on tuning your QRadar system.
• Fixed a number of minor defects.
Version 1.0.3
• Added Proxy related features.
• Detect QRadar version and disable downloading of apps depending on installed version.
• Fixed user interface issues.
• Fixed an issue where no Internet access / no proxy setup would result in an installaon failure.
Version 1.0.2
• Enhanced usability.
8
Version 1.0.1
• Minor styling changes.
RELATED DOCUMENTATION
Conguring the QRadar Assistant App | 9
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Conguring the QRadar Assistant App
The QRadar Assistant app is included in QRadar installaons of version 7.3.1 and later. You can
download the app from the IBM Security App Exchange for those versions. An Admin user must
congure certain opons to enable the Assistant app in your QRadar environment.
1. Click the Assistant app icon.
TIP: In QRadar versions 7.3.0 and earlier, click QRadar Assistant.
2. If you are the Admin conguring the Assistant app for the rst me, complete the following steps:
a. Enter a valid authorized service token into the banner on the Assistant app page and click Save.
NOTE: The security prole for the token must be Admin.
b. Click Sengs, select the API Authencaons tab, and enter your X-Force Exchange API Key and
API Password.
NOTE: Validaon of the API key can take several seconds.
NOTE: Aer an Admin congures the authorized service token and API key and password,
other Admin users do not need to perform this conguraon. Non-Admin users can use the
9
Assistant app, but are not authorized to download and install apps. To allow non-Admin users
to install apps, they must congure the Assistant app with an authorized service token that is
provided by an Admin.
3. To congure a proxy server for communicaon with X-Force Exchange, click Sengs, select the
Proxy tab, and enter the following informaon for your proxy server:
• Protocol
• Address
• Port
• User name
• Password
4. Click Save, then close the Sengs window.
5. If you want to use the QRadar Phone Home Service, click Agree.
For more informaon about the Phone Home Service, see "Phone Home" on page 18.
RELATED DOCUMENTATION
Managing Installed Extensions | 10
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Managing Installed Extensions
You can use the Installed secon on the Applicaons page to view and manage currently installed
QRadar extensions and contents.
1. Click the Assistant app icon , and then click Applicaons.
TIP: In QRadar versions 7.3.0 and earlier, click QRadar Assistant.
2. In the Installed secon, click View All to view applicaons by Installed Extensions, Installed Content,
and Custom Applicaons.
3. Hover your cursor over an applicaon card, and then click Quick View to open the Details Summary
pane.
10
Field Descripon
Manage Indicates the current status of the extension or
content.
Details Indicates the brief descripon of the extension
or content.
Delete Click to remove the extension or content.
Stop If available, click to deacvate the associated
applicaons.
NOTE: This opon is only available to
extensions and custom applicaons.
Start If available, click to acvate the associated
applicaons.
NOTE: This opon is only available to
extensions and custom applicaons.
4. Click the list view icon to view apps in a list. In Opons, you can perform the following tasks.
a. For extensions, you can select to either delete, stop, or start the selected item.
b. For contents, you can select to delete the selected item.
RELATED DOCUMENTATION
Managing Multenant Apps | 12
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
11
Managing Multenant Apps
IN THIS SECTION
Multenant Apps | 12
Conguring QRadar for Creang Mulple Instances | 13
Creang an Instance | 13
Managing Instances | 14
QRadar Assistant app 3.0.0 supports multenant environments in QRadar 7.4.0 Fix Pack 1 or later.
With QRadar Assistant 3.0.0 or later, you can manage instance for these apps (such as QRadar User
Behavior Analycs, QRadar Pulse, QRadar Log Source Management App) in a multenant environment.
You can create mulple instances and associate one instance to a security prole. By assigning a domain
to dierent security proles, you can segregate the events and ows that from dierent instances. For
example, you install a multenant app "Hello App" in a mul-divisional organizaon and you want to
create some security proles such as "Green Oce", "Blue Oce" with dierent domains. Aer you
create the security proles, you create mulple instances like "Hello App-Green Oce" and "Hello App-
Blue Oce" in a single shared deployment.
Use security proles and user roles to manage privileges for large groups of users in your environment.
Security proles and user roles ensure that users have access to only the informaon that they are
authorized to see.
Multenant Apps
You can create mulple instances for a multenant app to segregate dierent users. However, not every
QRadar app is supports multenancy, or needs to have mulple instances. In most cases, you would
have only one instance (default instance) aer the extension is installed. The default instance is globally
viewable for all users; you can assign the permissions in the user role sengs in JSA 7.3.1 or later.
12
Conguring QRadar for Creang Mulple Instances
You must congure QRadar administrave sengs to create mulple instances.
You can only create mulple instances with the QRadar Assistant 3.0.0 and QRadar 7.4.0 Fix Pack 1 and
later.
1. Create a security prole that would be associated later for the instance.
2. Create domains and associated those with the security prole specied in "Step 1" on page 13.
3. Create a user role that can access this app.
4. Create a user and associate to the specic security prole and user role.
5. Deploy changes.
1. Create a security prole "Blue Oce."
2. Create a user role named "DevOps."
3. Create a user named "blue-dev" to be associate with the security prole "Blue Oce" and the user
role "DevOps."
4. Deploy changes.
5. Create a new instance for the user "blue-dev."
Creang an Instance
With Assistant 3.0.0 and later in a mul-tenant environment, Admin users can create instance from a
mul-tenanted app.
You must complete the steps described in "Conguring QRadar for creang mulple instances" on page
13. Only Admin users can create new instances.
Every extension instance must be associated with a security prole. If an instance requires an authorized
service token, the authorized service must be assigned with the same security prole.
The opon Create New Instance is not available in the following situaons.
• The extension does not support multenancy: The extension is not multenancy aware and the
opon Create New Instance is not available.
13
• The extension only allows one instance to be created: Apps like Pulse, Log Source Management App,
and Assistant that are for administrave purposes can only have one instance.
1. Click the Assistant app icon, and then click Applicaons.
2. Ensure you're in the List View in Applicaon Manager.
3. In the Installed Extensions secon, click the ellipsis icon in the Opons column of the extension for
which you want to create an instance, and then click Create New Instance.
4. In the Create New Instance window, follow the onscreen instrucons to specify the Security prole
and User role, and then click Conrm and Create. Aer the instance is created, you can expand the
table and see a new row for this instance.
NOTE: Regarding the Installed Extension table,
• The Total Memory column shows the overall storage space used for all instances on the
corresponding extension. You can expand each row of the extension table to see more
details.
• Each row of the instance table is a grouped result. If an installed extension has two or
more apps, it would sll show only one row in the instance table but the memory
consumpon is a summaon of all apps.
5. Deploy changes in QRadar administrator page if the user roles are newly added.
Managing Instances
You can restart, stop, or congure an extension instance.
Stopping an extension instance will force logging o all users of that instance.
1. Click the Assistant app icon, and then click Applicaons.
2. Select the extension name whose instance you want to manage, and click the ellipsis icon in the
Opons column of the extension you want to manage.
Field Descripon
Start All Instances Start a stopped instance.
14
(Connued)
Field Descripon
Stop All Instances Stop an acve instance.
Delete All Instances Remove the instance.
Create New Instance Create a new instance.
Check for Updates Navigate to Full view for extension informaon.
Uninstall Extension Navigate to Extension Management for
PREVIEWING and Uninstall procedure.
NOTE: You need to uninstall all non-admin
instances before uninstalling the extension.
3. Click the ellipsis icon in the Opons column of the instance you want to manage.
Field Descripon
Start Instance Start a stopped instance.
Stop Instance Stop a running instance.
Delete Instance Remove the instance.
Congure Instance This opon is only available to the instances
that has exported the conguraon endpoints.
Aer clicking this opon, a sliding panel would
be displayed with the conguraon page
embedded in an iframe. Admin users can use
the page to congure the instance associated
with a specic security prole.
15
(Connued)
Field Descripon
View as [Security Prole Name] This opon is only available for the instances
that are associated with a non-admin security
prole. Admin user can use this funcon to
override the permission temporarily and to see
all instances associated with the specied
security prole.
NOTE: You need to refresh the browser to see
the addional instances granted by the override
permission.
Hide This opon is only available aer View as
[Security Prole] is selected. Click Hide to
toggle the overriding permission of the Admin
user.
RELATED DOCUMENTATION
Downloading Apps with the QRadar Assistant App | 16
Phone Home | 18
Congure URL Access on Firewalls | 21
Downloading Apps with the QRadar Assistant App
On the Applicaons page, you can download and install apps from the X-Force Exchange.
1. Use any of the following methods to nd apps:
16
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28

Juniper JSA3800 User guide

JSA3800
Juniper
Brand
Juniper
Model
JSA3800
Type
User guide
This manual is also suitable for
Download PDF
report

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI

Related papers

Other documents