isIPsafe

IBM QRadar

Load the list into a reference set and use it in rules and AQL.

QRadar rules and searches can test addresses against a reference set. Load the blocklist into one with the QRadar API and refresh it hourly.

Set it up

  1. Create an authorized service token in Admin › Authorized Services with a role that may manage reference data.
  2. Create the reference set once; entries expire seven days after they were last loaded, so addresses that leave the list age out: 
    curl -s -X POST -H "SEC: $QRADAR_TOKEN" -H "Accept: application/json" \
  "https://qradar.example.com/api/reference_data/sets?name=isipsafe&element_type=IP&timeout_type=LAST_SEEN&time_to_live=7%20days"
  3. Load the list hourly from cron (needs jq): 
    curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=json&confidenceMinimum=75&limit=100000" \
  | jq '[.data[].ipAddress]' \
  | curl -s -X POST -H "SEC: $QRADAR_TOKEN" -H "Content-Type: application/json" --data @- \
      "https://qradar.example.com/api/reference_data/sets/bulk_load/isipsafe"

Use it

In a rule, add the test when any of Source IP are contained in any of isipsafe - IP. In a search:

SELECT sourceip, QIDNAME(qid), COUNT(*) FROM events
WHERE REFERENCESETCONTAINS('isipsafe', sourceip)
GROUP BY sourceip, qid LAST 24 HOURS

Need a hand?

If something here does not work with your version of IBM QRadar, or you have improved it, tell us. We update these pages with what people send.

IBM QRadar and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.