Integration of QRadar Disaster Recovery Synchronization Tools

Summary

A major US life insurance company needed to guarantee the flawless operation of its IBM QRadar SIEM, even in the event of a failure. Alongside its primary high-capacity QRadar console, the company added a backup Disaster Recovery (DR) console of the same architecture in a separate geographic environment. INNERLUXES's SIEM consultants developed two synchronization tools that keep the standby DR console mirrored to the primary one, so it can take over seamlessly if the primary console fails.

About the Client

The Client is a major US life insurance company catering to retail and institutional investors.

The Challenge

The Client knows firsthand that its clients' valuable data must be secured 24/7. The adverse impact of data breaches on client loyalty and the company's reputation, coupled with considerable financial losses, drove the Client to implement a solution ensuring the flawless operation of its IBM QRadar SIEM system.

The Solution

In addition to the primary QRadar console, the company purchased a backup Disaster Recovery (DR) console with the same architecture. Located in a different geographic environment, the backup QRadar system substitutes for the primary console if the latter fails.

A previous multi-stage project — which included out-of-the-box log source configuration, QRadar fine-tuning, custom DSM development, and end-user training — convinced the Client to continue collaborating with INNERLUXES, so INNERLUXES's SIEM consultants embarked on the Disaster Recovery project for the Client's QRadar system.

The Client chose the DR scenario in which only one console is operational at a time. Once the primary console fails, security specialists manually switch to the backup DR console. To enable the backup QRadar console to mirror the primary one, INNERLUXES's SIEM consultants developed two tools for DR synchronization.

Tool #1: for data transfer

This tool transfers the configuration backup archive from the primary QRadar console to the backup (DR) console. It runs on the primary QRadar system and is written in Shell. The tool supports local and remote (via SSH) transfer options; the local option can be used when the target network drive is mounted via NFS or similar.

Tool #2: for data extraction

This tool extracts security content (correlation rules, custom DSMs, reports, dashboards, etc.) from the primary QRadar console and applies it to the DR console. It runs on the DR console and is written in Python. Using QRadar console credentials, the tool performs the following operations:

• Executes the Content Management Tool (CMT) and waits for import completion.
• Analyzes the import log for errors and warnings.
• Transfers export results to a temporary folder.
• Imports security content.
• Performs a full deployment.
• Packs the content export into a zip archive and copies it to a specific folder.
• Calculates statistics on imported entries (how many rules, custom properties, searches, etc. are imported).
• Removes the temporary export file.

Both tools also let administrators receive email notifications with the status of transfer and extraction operations (success/failure), along with security content import statistics, errors, and warnings.

The Results

• INNERLUXES's SIEM consultants provided the Client with disaster recovery synchronization tools and a detailed configuration guide.
• Once integrated, the DR synchronization tools safeguard the Client's QRadar data and configurations to provide seamless network security monitoring.

Technologies and Tools

IBM Security QRadar SIEM, Python, Regex, Linux Shell.