This is the Ansible Collection provided by the Ansible Security Automation Team for automating actions in IBM QRadar SIEM.
This Collection is meant for distribution through Ansible Galaxy as is available for all Ansible users to utilize, contribute to, and provide feedback about.
-
Join the Ansible forum:
- Get Help: get help or help others.
- Social Spaces: gather and interact with fellow enthusiasts.
- News & Announcements: track project-wide announcements including social events.
-
The Ansible Bullhorn newsletter: used to announce releases and important changes.
For more information about communication, see the Ansible communication guide.
This collection has been tested against following Ansible versions: >=2.15.0.
For collections that support Ansible 2.9, please ensure you update your network_os
to use the
fully qualified collection name (for example, cisco.ios.ios
).
Plugins and modules within a collection may be tested with only specific Ansible versions.
A collection may contain metadata that identifies these versions.
PEP440 is the schema used to describe the versions of Ansible.
Name | Description |
---|---|
ibm.qradar.qradar | HttpApi Plugin for IBM QRadar |
Name | Description |
---|---|
ibm.qradar.deploy | Trigger a qradar configuration deployment |
ibm.qradar.log_source_management | Manage Log Sources in QRadar |
ibm.qradar.offense_action | Take action on a QRadar Offense |
ibm.qradar.offense_info | Obtain information about one or many QRadar Offenses, with filter options |
ibm.qradar.offense_note | Create or update a QRadar Offense Note |
ibm.qradar.qradar_analytics_rules | Qradar Analytics Rules Management resource module |
ibm.qradar.qradar_log_sources_management | Qradar Log Sources Management resource module |
ibm.qradar.rule | Manage state of QRadar Rules, with filter options |
ibm.qradar.rule_info | Obtain information about one or many QRadar Rules, with filter options |
You can install the IBM qradar collection with the Ansible Galaxy CLI:
ansible-galaxy collection install ibm.qradar
You can also include it in a requirements.yml
file and install it with ansible-galaxy collection install -r requirements.yml
, using the format:
---
collections:
- name: ibm.qradar
An example for using this collection to manage a log source with IBM QRadar is as follows.
inventory.ini
(Note the password should be managed by a Vault for a production environment.
[qradar]
qradar.example.com
[qradar:vars]
ansible_network_os=ibm.qradar.qradar
ansible_user=admin
ansible_httpapi_pass=SuperSekretPassword
ansible_httpapi_use_ssl=true
ansible_httpapi_validate_certs=true
ansible_connection=httpapi
NOTE: For Ansible 2.9, you may not see deprecation warnings when you run your playbooks with this collection. Use this documentation to track when a module is deprecated.
With Ansible Collections there are various ways to utilize them either by calling specific Content from the Collection, such as a module, by its Fully Qualified Collection Name (FQCN) as we'll show in this example or by defining a Collection Search Path as the examples below will display.
I should be noted that the FQCN method is the recommended method but the shorthand options listed below exist for convenience.
qradar_with_collections_example.yml
---
- name: Testing URI manipulation of QRadar with FQCN
hosts: qradar
gather_facts: false
tasks:
- name: create log source
ibm.qradar.log_source_management:
name: "Ansible Collections Example Log Source"
type_name: "Linux OS"
state: present
description: "Ansible Collections Example Log Source Description"
Below we specify our collection at the
Play
level which allows us to use the log_source_management
module without
the need for the FQCN for each task.
qradar_with_collections_example.yml
---
- name: Testing URI manipulation of QRadar
hosts: qradar
gather_facts: false
collections:
- ibm.qradar
tasks:
- name: create log source
log_source_management:
name: "Ansible Collections Example Log Source"
type_name: "Linux OS"
state: present
description: "Ansible Collections Example Log Source Description"
Another option for Collection use is below. Here we use the
block
level keyword instead of Play
level as with the previous example. In this scenario we are able to use the
log_source_management
module without the need for the FQCN for each
task but with an optionally more specific scope of Collection Search Path than
specifying at the Play level.
qradar_with_collections_block_example.yml
---
- name: Testing URI manipulation of QRadar
hosts: qradar
gather_facts: false
tasks:
- name: collection namespace block
block:
- name: create log source
log_source_management:
name: "Ansible Collections Example Log Source"
type_name: "Linux OS"
state: present
description: "Ansible Collections Example Log Source Description"
collections:
- ibm.qradar
docs/
: local documentation for the collectionlicense.txt
: optional copy of license(s) for this collectiongalaxy.yml
: source data for the MANIFEST.json that will be part of the collection packageplaybooks/
: playbooks reside heretasks/
: this holds 'task list files' forinclude_tasks
/import_tasks
usage
plugins/
: all ansible plugins and modules go here, each in its own subdirmodules/
: ansible moduleslookups/
: lookup pluginsfilters/
: Jinja2 filter plugins- ... rest of plugins
README.md
: information file (this file)roles/
: directory for ansible rolestests/
: tests for the collection's content
We welcome community contributions to this collection. If you find problems, please open an issue or create a PR against the IBM QRadar collection repository. See Contributing to Ansible-maintained collections for complete details.
This collection follows the Ansible project's Code of Conduct. Please read and familiarize yourself with this document.
Release notes are available here.
- Ansible Collection overview
- Ansible User guide
- Ansible Developer guide
- Ansible Community code of conduct
GNU General Public License v3.0 or later.
See LICENSE to see the full text.