You can configure Red Hat Advanced Cluster Security for Kubernetes to send events to QRadar by configuring a generic webhook integration in RHACS.
The following steps represent a high-level workflow for integrating RHACS with QRadar:
Configure the generic webhook.
When configuring the integration in RHACS, in the Endpoint field, use the following example as a guide:
Identify policies for which you want to send notifications, and update the notification settings for those policies.
If QRadar does not automatically detect the log source, add an RHACS log source on the QRadar Console. For more information on configuring QRadar and RHACS, see the Red Hat Advanced Cluster Security for Kubernetes IBM resource.
Create a new integration in Red Hat Advanced Cluster Security for Kubernetes by using the webhook URL.
On the RHACS portal, navigate to Platform Configuration → Integrations.
Scroll down to the Notifier Integrations section and select Generic Webhook.
Click New integration.
Enter a name for Integration name.
Enter the webhook URL in the Endpoint field.
If your webhook receiver uses an untrusted certificate, enter a CA certificate in the CA certificate field. Otherwise, leave it blank.
The server certificate used by the webhook receiver must be valid for the endpoint DNS name. You can click Skip TLS verification to ignore this validation. Red Hat does not suggest turning off TLS verification. Without TLS verification, data could be intercepted by an unintended recipient.
Optional: Click Enable audit logging to receive alerts about all the changes made in Red Hat Advanced Cluster Security for Kubernetes.
Red Hat suggests using separate webhooks for alerts and audit logs to handle these messages differently.
To authenticate with the webhook receiver, enter details for one of the following:
Username and Password for basic HTTP authentication
Custom Header, for example:
Authorization: Bearer <access_token>
Use Extra fields to include additional key-value pairs in the JSON object that Red Hat Advanced Cluster Security for Kubernetes sends.
For example, if your webhook receiver accepts objects from multiple sources, you can add
"source": "rhacs" as an extra field and filter on this value to identify all alerts from Red Hat Advanced Cluster Security for Kubernetes.
Select Test to send a test message to verify that the integration with your generic webhook is working.
Select Save to create the configuration.
Enable alert notifications for system policies.
On the RHACS portal, navigate to Platform Configuration → Policies.
Select one or more policies for which you want to send alerts.
Under Bulk actions, select Enable notification.
In the Enable notification window, select the webhook notifier.
If you have not configured any other integrations, the system displays a message that no notifiers are configured.