IBM QRadar: Developing QRadar Applications: Difference between revisions

From Wiki
No edit summary
No edit summary
Line 1: Line 1:
Some apps require dependencies to be pulled down (if so it is explained in the apps' README), to pull down the required dependencies make sure you have the following installed:
= Developing QRadar Applications =


* Python 3 and pip
Some QRadar applications require additional dependencies to be installed. When this is the case, it will be clearly outlined in the app’s `README.md` file.
* Docker
* QRadar App SDK v2 - '''Current version 2.2.3'''


Before starting, ensure your system has the following installed:


= Setup your environment =
* Python 3.x and pip
* Docker (preferably Docker-CE)
* '''QRadar App SDK v2 — Current version: 2.2.3'''


== Install Docker ==
== Preparing Your Environment ==


1) Install Docker-CE on RHEL/CentOS 8
=== Installing Docker on RHEL/CentOS 8 ===


sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
1) Enable required repositories and install dependencies:
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf install pass


Important: If you already have Podman/ContainerD, you must remove
<pre>
sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf install pass
</pre>


sudo dnf uninstall podman runc
2) Remove Podman or ContainerD if already installed (they conflict with Docker):


2) Start Docker-CE
<pre>
sudo dnf remove podman runc
</pre>


sudo systemctl enable docker
3) Install Docker-CE:
sudo systemctl start docker


3) Check Do
<pre>
sudo dnf install docker-ce docker-ce-cli containerd.io
</pre>


sudo usermod -aG docker <MY USER>
4) Enable and start the Docker service:


== Install QRadar SDK ==
<pre>
sudo systemctl enable docker
sudo systemctl start docker
</pre>


4) Download Qradar SDK from XForce
5) Add your user to the docker group:


https://exchange.xforce.ibmcloud.com/hub/extension/517ff786d70b6dfa39dde485af6cbc8b
<pre>
sudo usermod -aG docker &lt;YOUR_USER&gt;
</pre>


5) Extract package
''Note: You must log out and log back in for this change to take effect.''


mkdir SDK
=== Installing the QRadar App SDK ===
cd SDK
unzip QRadarAppSDK-2.2.3.zip


1) Download the SDK from IBM X-Force Exchange:


6) Run installer
[https://exchange.xforce.ibmcloud.com/hub/extension/517ff786d70b6dfa39dde485af6cbc8b QRadar App SDK 2.2.3]


Is important to have sudo permission, because script create a qapp in /usr/local/bin/
2) Extract the SDK package:


./install.sh
<pre>
mkdir SDK
cd SDK
unzip QRadarAppSDK-2.2.3.zip
</pre>


3) Run the installer script:


== Cloning sample repository ==
<pre>
sudo ./install.sh
</pre>


Let's get some examples
This script installs the `qapp` CLI tool to `/usr/local/bin/`.


1) Clone the repository and go to HelloWorld application
Verify the installation:


git clone https://github.com/IBM/qradar-sample-apps.git
<pre>
qapp --version
cd qradar-sample-apps/HelloWorld
</pre>


2) Change manifest.json
== Cloning Sample Applications ==


Let's change the default image, with a new one.
1) Clone IBM’s sample applications repository:


"image": "qradar-app-base:4.0.0",
<pre>
git clone https://github.com/IBM/qradar-sample-apps.git
cd qradar-sample-apps/HelloWorld
</pre>


3) Run HelloWorld
2) Update the `manifest.json` file to change the base image, if necessary:


qapp run
<pre>
"image": "qradar-app-base:4.0.0",
</pre>


== Deploy on QRadar ==
== Running the Application Locally ==


1) Create a package
Run the HelloWorld app in a local Docker container:


<pre>
qapp run
</pre>
This will start the application locally for testing purposes.
== Packaging and Deploying to QRadar ==
1) Create a deployment package:
<pre>
  qapp package -p app.zip
  qapp package -p app.zip
</pre>


2) Deploy on QRadar
2) Deploy the application to a QRadar instance:
 
qapp deploy -p app.zip -q 192.168.42.150 -u admin


= Ver também =
<pre>
qapp deploy -p app.zip -q &lt;QRADAR_IP&gt; -u &lt;USERNAME&gt;
</pre>


* [[IBM QRadar| Artigos sobre IBM QRadar]]
Example:
* [[Cloud| Artigos sobre Cloud]]
* [[Tecnologias|  Mais Artigos sobre Cloud / WebDev / Tecnologias]]


[[Category:IBM QRadar]]
<pre>
qapp deploy -p app.zip -q 192.168.42.150 -u admin
</pre>

Revision as of 12:03, 28 July 2025

Developing QRadar Applications

Some QRadar applications require additional dependencies to be installed. When this is the case, it will be clearly outlined in the app’s `README.md` file.

Before starting, ensure your system has the following installed:

  • Python 3.x and pip
  • Docker (preferably Docker-CE)
  • QRadar App SDK v2 — Current version: 2.2.3

Preparing Your Environment

Installing Docker on RHEL/CentOS 8

1) Enable required repositories and install dependencies: 

sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf install pass

2) Remove Podman or ContainerD if already installed (they conflict with Docker): 

sudo dnf remove podman runc

3) Install Docker-CE: 

sudo dnf install docker-ce docker-ce-cli containerd.io

4) Enable and start the Docker service: 

sudo systemctl enable docker
sudo systemctl start docker

5) Add your user to the docker group: 

sudo usermod -aG docker <YOUR_USER>

Note: You must log out and log back in for this change to take effect.

Installing the QRadar App SDK

1) Download the SDK from IBM X-Force Exchange:

QRadar App SDK 2.2.3

2) Extract the SDK package: 

mkdir SDK
cd SDK
unzip QRadarAppSDK-2.2.3.zip

3) Run the installer script: 

sudo ./install.sh

This script installs the `qapp` CLI tool to `/usr/local/bin/`.

Verify the installation: 

qapp --version

Cloning Sample Applications

1) Clone IBM’s sample applications repository: 

git clone https://github.com/IBM/qradar-sample-apps.git
cd qradar-sample-apps/HelloWorld

2) Update the `manifest.json` file to change the base image, if necessary: 

"image": "qradar-app-base:4.0.0",

Running the Application Locally

Run the HelloWorld app in a local Docker container: 

qapp run

This will start the application locally for testing purposes.

Packaging and Deploying to QRadar

1) Create a deployment package: 

 qapp package -p app.zip

2) Deploy the application to a QRadar instance: 

qapp deploy -p app.zip -q <QRADAR_IP> -u <USERNAME>

Example: 

qapp deploy -p app.zip -q 192.168.42.150 -u admin
Retrieved from "https://ebasso.net/wiki/index.php?title=IBM_QRadar:_Developing_QRadar_Applications&oldid=9577"