- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Log exporter TLS config with QRadar
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Log exporter TLS config with QRadar
Hello,
I am trying to configure log exporter with TLS to send LEEF format events to QRadar.
I followed the steps here:
QRadar link: https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/t_dsm_guide_Checkpoint_tls_en...
Checkpoint link: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
But the handshake is not established because of an unknown certificate error.
The issue may be because of the signed certificate that I generated.
I also saw in other questions that this issue can be related to the Common Name used when generating the root CA.
Any advice here please?
Thanks,
Salma
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Thank you all.
The issue was resolved with IBM:
1- generate the certificates following this tech note: https://www.ibm.com/docs/en/dsm?topic=point-integrating-check-by-using-tls-syslog
- for each certificate (rootCA, log_exporter, and syslogServer), use a different CN (any string, it doesn't have to be an IP)
2- put the rootCA files in /etc/pki/ca-trust/source/anchors/
3- run this command: update-ca-trust
And it worked!
Hope this will help.
Bes,
Salma
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It would help if you posted the precise error message you received.
Not to mention version/JHF level of all relevant components.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Others have solved similar issues:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Thank you all.
The issue was resolved with IBM:
1- generate the certificates following this tech note: https://www.ibm.com/docs/en/dsm?topic=point-integrating-check-by-using-tls-syslog
- for each certificate (rootCA, log_exporter, and syslogServer), use a different CN (any string, it doesn't have to be an IP)
2- put the rootCA files in /etc/pki/ca-trust/source/anchors/
3- run this command: update-ca-trust
And it worked!
Hope this will help.
Bes,
Salma
