QRadar Community Edition offers a great way to better understand the product. I have decided to install QRadar CE on a VM at home to give it a try. Now, I do not run any of the big firewalls that they support but I do run pfSense, which I believe is one of the best solutions for the home network.
After doing a couple of searches on the Internet, I found that there is no DSM for pfSense logs available for QRadar. I had decided to give a try on my own custom DSM to parse these logs. After some time and effort, I have been able to properly parse the following logs from pfSense in QRadar:
- Firewall Logs
- DHCP Events
- DNS Queries
I have also been able to run Snort and softflowd (Netflow) on pfSense and send the IDS logs and flow information to QRadar.
In this article, we will be showing how to send the pfSense Firewall Logs into QRadar and use the custom log source extension I am providing to help parse the logs correctly. Note that this is a work in progress and there are events that are not correctly parsed, or not parsed at all. Also, the regular expressions that I am using may not be the most efficient, but at least they will get the job done. Any recommendations on improving them will be appreciated in the comments. This LSE works for pfSense 2.2 and above.
You can download the XML file here.
Creating the Custom Log Source Extension in QRadar:
The following steps go through the process of creating a log source extension for QRadar and uploading the XML file.
- In QRadar, go to Admin page and click DSM Editor under the Data Sources / Events section.
- In the DSM Editor screen you will be prompted to select a Log Source Type, click “Create New”.
- Enter the name “pfSense” for the new Log Source Type and then click Save.
- Close the DSM Editor and then click on Log Source Extensions in the Admin page.
- In the Log Source Extension screen, click “Add”
- In the Name Field type: “pfSenseCustom_ext” (without the quotes).
- Type a description in the Description field.
- In the log source types section, look for the one you created called “pfSense” and click the button to move it to the right to set this Log Source Extension as default for the pfSense Log source Type.
- Use the Upload Extension to upload the XML provided in the link above.
- Once the XML file has been uploaded click on Save.
You will now be able to parse logs for pfSense by using this new log source extension.
Configure Event Mappings
Once you’re able to correctly parse the information in QRadar, you will still need to map the events to existing QIDs so that QRadar can know what type of event it is. For example, a Firewall Deny or a Firewall allow are two different type of events and may generate different offenses according to your rules.
There are a couple of tools that I have tried to use to export the QIDMAPs including the qidmap_cli.sh tool. However, I have not yet had any luck exporting the event mappings, therfore, they need to be created manually.
Mapping of pfSense Events
- In the QRadar Admin page, select DSM Editor
- Selct the pfSense Log Source Type
- Click on the Event Mappings tab and then click the “+” button to create a new mapping.
- Use the tables below to enter the values for each event. You will need to enter the event ID and category, then click the Choose Event link to search for the QID/Event
- Type in the event name as shown in the tables below, select the matching event and click OK.
- Click create to finish creating the mapping.
There are only two main event mappings used for Firewall Events which are the most common events that you will be getting from pfSense.
|Firewall Permit||pass||filterlog||Firewall Permit – Event CRE|
|Firewall Deny||block||filterlog||Firewall Deny – Event CRE|
In order to get DNS Queries you will need to be using unbound as your DNS service in pfSense. Unbound is the default DNS service in pfSense 2.3 and above. You will also need to configure unbound to send DNS query events to the system logs. This is described in the Configuring pfSense to Send Logs to QRadar section below. The mappings below correspond to DNS Query events.
|A Query||A||unbound||DNS Query – A record|
|Quad-A Query||AAAA||unbound||DNS Query – AAAA record|
|CNAME Query||CNAME||unbound||DNS Query – CNAME record|
|MX Query||MX||unbound||DNS Query – MX record|
|NS Query||NS||unbound||DNS Query – NS record|
|PTR Query||PTR||unbound||DNS Query – PTR record|
|SOA Query||SOA||unbound||DNS Query – SOA record|
|SRV Query||SRV||unbound||DNS Query – SRV record|
|TXT Query||TXT||unbound||DNS Query – TXT record|
DHCP Events Mappings:
DHCP Events also include identity fields. This will allow QRadar to update the discovered assets using DHCP event information. In order to obtain the identity information, you will need to override the Identity Fields for events. To do this, once the mappings have been created and saved, click on the Override default identity fields for this event. Then click Select in the Identity Fields section. Select all available properties and then click OK The following table includes the DHCP events that are mapped.
Configuring pfSense to Send Logs to QRadar
Now that we have created the custom DSM and custom mappings, we move on into pfSense to configure it to send the logs to QRadar via syslog. The following steps need to be performed on the pfSense administration console.
- Go to Status -> System Logs. Then click on Settings on the far right side.
- In the System Logs / Settings page, scroll down to the remote logging options and enter the following:
- Enable remote logging: Check
- Source Address: Select the interface whose address you want to use as the source address. I recommend that you select the interface where your QRadar system is connected to. For example, if QRadar has an IP address in the LAN Segment, then use the LAN interface as source address. You will need to make note of the the IP address for pfSense on this interface since you will be using it when you configure the Log Source identifier.
- Remote log servers: <QRADAR IP>:<PORT>. For example, if QRadar is 172.31.250.10, then you type in 172.31.250.50:514. Most cases will use the default 514 port.
- Remote SYSLOG Contents. Here I selected everything, however, this setting allows you the option of being more granular as to what information is sent to QRadar.
3. Once you have all the settings you need, click save.
Enable DNS Query Events in pfSense:
By default, pfSense does not log all DNS Queries. I had tried enabling this logging in the unbound log settings but did not work. In order to enable the logging of DNS queries you will need to configure it in the custom options:
- In the pfSense menu, go to Services -> DNS Resolver.
- Scroll down and click on the Display Custom Options button.
- In the Custom Options text box, type in the following:log-queries: yes
Edit: A reader pointed out that the correct unbound custom options should also contain the line “server:” above the “log-queries: yes” line. If not, unbound will not send the DNS logs via syslog. Thank you for the heads up!
Creating the pfSense Log Source in QRadar
Finally, we need to configure the log source in QRadar.
- In the QRadar Admin Page, Click Log Sources.
- Click Add
- Use the following parameters:
Log Source Name : Type in a name for the log source
Log Source Description : Type in a descryption
Log Source Type : pfSense
Protocol Configuration : Syslog
Log Source Identifier : IP of the interface used above.
Target Event Collector: Leave as is
Coalescing Events: Unchecked
Incoming Payload Encoding: UTF-8
Store Event Payload: Checked
Log Source Language: Leave as is
Log Source Extension: pfSenseCustom_ext
4. Click Save
This concludes the configuration of the pfSense log source. Once finished, you can go to the log activity tab in QRadar and filter for the pfSense log source. You should now be able to view pfSense Events.
Note that not all events from pfSense are parsed correctly. I may not need to add all of the different event types that pfSense generates since I do not use all of them. However, feel free to create your own and share them with the community.