IBM/qradar-sample-apps

QRadar Sample Apps for use with V2 of the QRadar App Framework

QRadar sample apps

This repository holds a number of QRadar sample apps, built using v2 of the QRadar App Framework. These apps are based on the Red Hat Universal Base Image, not the old CentOS 6 app image.

Using these samples

To use the samples it is recommended you have the QRadar App SDK v2 installed, which allows you to bundle apps through its command line interface and deploy them to QRadar, or even run the apps locally.

Some apps require dependencies to be pulled down (if so it is explained in the apps' README), to pull down the required dependencies make sure you have the following installed:

• Python 3 and pip - To download required Python modules.
• Docker - To download required Red Hat RPMs.
• QRadar App SDK v2 - To run apps locally and to deploy to a QRadar system.

Samples

• Replace Flask with an Alternative HTTP Server
• Determine available QRadar API versions and features
• Use the QPyLib Ariel features
• Run a command as root during app startup
• Use Carbon components with QRadar App SDK v2
• Allow user uploaded custom certificate
• Add an extra column to the offenses table on the offenses page and uses JS to render content
• Add an extra column to the assets table on the assets page
• Add an extra column globalized to the offenses table on the offenses page
• Control browser cache
• Provide a dashboard item with an image
• Use QPyLib to encrypt values
• Inject environment variables from the app manifest
• Use GUI Actions
• Replace Flask with Gunicorn
• Simple 'hello world' app
• Globalized 'hello world' app
• Add hover over information to IP address data
• Designate how much memory an app needs
• Config Pages in different locations
• Use multiple UI components (Areas, Dashboards, Config Pages, GUI Actions, Page Scripts, Metadata Providers) in a single app
• Support multi-tenancy
• Use NGINX rather than Flask
• Use NodeJS rather than Flask
• Use QRadar OAuth to authenticate the app
• Use a PostgreSQL database
• Retrieve proxy values
• Use QJSLib imported through the browser
• Use QJSLib imported through NPM
• Allow user submitted QRadar Vulnerability Manager scans
• Use a REST method to populate a Dashboard Item
• Use a SQLite database
• Create an app without user role

Project details

• CONTRIBUTING
• MAINTAINERS