Send text messages from QRadar ”Custom Actions” using Twilio API in a bash file.
Setup
- Create an account from http://www.twilio.com
- Retrieve Phone number, Id, and Token generated under your dashboard
- Apply Phone number, Id, and Token into script
- Call script into QRadar, see QRadar setup below
QRadar Setup
- Go to Admin tab and select Define Actions under Custom Actions
- Select Add from top menu options
- Provide the following:
- Name
- Description
- Interpreter: Bash
- Upload SMS Bash/Curl script
- Parameter Name
- Fix Property Value
- Click Add
- Click Save
To add these entries into the ariel right-click menu, copy this file into /opt/qradar/conf and restart tomcat.
The following options are included:
- Bluecoat
- Cisco Talos
- DomainTools
- Google Cached View
- LOLBAS
- Maclookup
- Robtex
- SpeedGuide
- ThreatCrowd
- URLVoid
- Userstack
- VeriSign
To add these entries into the right-click menu, copy this file into /opt/qradar/conf and restart tomcat.
The following options are included:
- Nmap
- Ping
- Traceroute
- X-Force Exchange
- AbuseIPDB
- AlienVault OTX
- Censys
- Cisco Talos
- DNSlytics
- DShield
- Google Safe Browsing
- GreyNoise
- IPVoid
- MxToolBox Blacklist
- Project Honey Pot
- Robtex
- Shodan
- Spamhaus Reputation Checker
- ThreatCrowd
- ThreatMiner
- VirusTotal
Gathers information and presents an HTML status report about your QRadar deployment.
All content is without warranty of any kind. Use at your own risk. I assume no liability for the accuracy, correctness, completeness, usefulness, or any damages.
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies.