QRadar SIEM - Create a rule for Malware domain detection

In the previous post, I already created a Reference set for Malware domain.
This time, we will create a rule when one of the malware domain list matches our proxy server domain event properties.

1 Create Rule
   Offences > Rule > Action > New event rule

2. Select Event properties. Click these event properties

3. Select Reference Set. Click these reference set(s)

4. Next. Add your email address for alert.

Qradar SIEM - Adding Malware Domain Reference Set

1. Download the list of malware domain here: malware list
2. Create a new Reference set.
    Name: Malware Domain List
    Type: AlphaNumeric
 

3. Export the list in Qradar reference set.
    Admin > System Configuration > Reference set management

Communication to a known Bot C&C Server

Description: Communication to a known Bot Command and Control
Destination: 163.172.81.35

Where the list came from?
root@qradar# cat /opt/qradar/conf/remotenet.conf | grep IP_Address