Enable MFA for QRadar by using Okta

Hi @sokd.51915 (Customer)​ , Thank you for reaching out to the Okta Community! 

QRadar is not currently listed under the Okta Integration Network (OIN) [link: https://www.okta.com/integrations/], as such, no explicit implementation documentation is available.

If QRadar supports SAML SSO, you will need to leverage a custom SAML app implementation via the Okta Application Integration Wizard [link: https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm ].

Solution: Create a SAML 2.0 app integration for QRadar, attach an MFA-enforcing sign-on policy to it, and connect QRadar to the Okta metadata.

1. Create a SAML 2.0 app integration in the Okta Admin Console under Applications → Applications → Create App Integration, and select SAML 2.0 as the sign-in method.
2. Enter the Assertion Consumer Service (ACS) URL and the Audience URI (Entity ID) from your QRadar SAML configuration in the General Settings and SAML Settings steps.
3. Set the Name ID format and the application username so that the Okta username matches the username stored in QRadar. Add any attribute statements QRadar requires.
4. Assign the QRadar application to the users or groups who need console access under the Assignments tab.
5. Create or edit an authentication policy for the QRadar application under Security → Authentication Policies. Add a rule that requires the Okta Verify factor, and confirm that Okta Verify is active under Security → Authenticators and included in your MFA enrollment policy so users can enroll it. Okta Verify must be enrolled before the rule can be satisfied.
6. Download the Identity Provider metadata or copy the Identity Provider Single Sign-On URL, the Identity Provider Issuer, and the X.509 signing certificate from the app's Sign On tab.
7. Add that metadata or enter those values into the SAML authentication settings in QRadar, then enable SAML as the authentication method for console logins.
8. Test a sign-in in a private browser session. Confirm that Okta prompts for Okta Verify and that QRadar accepts the assertion. Review the System Log in Okta and QRadar Logs for the sign-on event if the login fails.

References: 

Okta Application Integration Wizard SAML implementation: https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm

Okta documentation on creating an MFA enrollment policy: https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/create-mfa-policy.htm

Okta App Sign-in policies documentation: https://help.okta.com/oie/en-us/content/topics/identity-engine/policies/about-app-sign-on-policies.htm

Getting Started with the Okta System Log: https://support.okta.com/help/s/article/getting-started-with-okta-system-logs?language=en_US

For QRadar-specific SAML field values and configuration values, please engage the Service Provider (QRadar) support and/or documentation. 

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added