topic Re: No Malware Events Seen - eStreamer Integration(FMC & IBM Qradar)!! in Endpoint Security

No Malware Events Seen - eStreamer Integration(FMC & IBM Qradar)!!

tushar_bangia — Sat, 09 Mar 2019 01:45:16 GMT

Hi Team,

I need some assistance to have visibility for Malware events on IBM Qradar, the estreamer integration works fine and I can see events, IPS, Connection logs however I cant see any Malware events.

I have tried to generate Malware events for both Network and Endpoint level (AMP VPC is also integrated with FMC) however I am unable to see any Malware logs/events. The connection events does report connection to the site from where I am downloading test Malware samples.

The events are seen on the FMC however the SIEM/IBM Qradar is unable to report any information. Please suggest if we need to do anything additional.

Re: No Malware Events Seen - eStreamer Integration(FMC & IBM Qradar)!!

tushar_bangia — Mon, 27 Nov 2017 13:18:57 GMT

I can only find below close matching caveat however the bug lacks information.

CSCvc91960 - Streamed Malware events uses the connection event direction

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc91960

Re: No Malware Events Seen - eStreamer Integration(FMC & IBM Qradar)!!

IvanCdC — Wed, 29 Nov 2017 16:43:56 GMT

Hello Tushar,

Based on the info provided, I'd suggest you to contact IBM as well to double check settings and app logs.

QRadar is using estreamer FMC API but ultimately it's IBM's app the one generating the data.

I'd also suggest you should open a case to the FMC team as this is a matter of extensive investigation.

Regards!

Re: No Malware Events Seen - eStreamer Integration(FMC & IBM Qradar)!!

santhakumar.saseendran — Wed, 31 Jan 2018 17:11:09 GMT

we have a similar problem

Have you checked payload for malware traces? In my case i have traced some payloads with malware details etc , but they did not come from intended Log Source (i believe it should come from Log source Firesight) instead from Log source source snort@ firewall name and hence resulting in unknown event.

Please update if you have an answer by now