QRadar Custom Right-Click Menu for IP Addresses

In your SIEM here's how to setup a custom Right-Click menu for IP Address

1.) Open ip_context_menu.xml with an editor like 'nano' (Likely located in /opt/qradar/conf)

2.) Add the following line
<contextMenu>
<menuEntry name="ARIN Lookup" url="http://whois.arin.net/rest/ip/%IP%" />
</contextMenu>
3.) Restart the tomcat service (Admin -> Advanced -> Restart Web Server)

4.) Enjoy the results!




Copyright © 2015, this post cannot be reproduced or retransmitted in any form without reference to the original post.