IBM QRadar: DNSDB app build guide

This guide describes how to package, deploy, and export the Farsight DNSDB app for IBM QRadar using the QRadar Application SDK. It’s intended for developers who build the app package from source and submit it to the IBM App Exchange, not for end users installing the published app.

Prerequisites

You need the QRadar Application SDK and access to a QRadar instance.

QRadar Application SDK

Download and install the QRadar Application SDK from the IBM documentation, and follow IBM’s installation guide for your platform. Two requirements matter:

Install the QRadar Application SDK as a non-root user.
Docker must be installed first — it’s a prerequisite for the SDK.

Once the SDK is installed correctly, the qapp command is available to your user.

QRadar instance

To deploy and export a package, you need access to a running QRadar instance. Record its console IP address or hostname, username, and password before you start.

Package the app with the SDK

First, package the app with the SDK you installed.

Download the application source code from GitHub and change into the DNSDB_QRadarApp_Source folder.

From that folder, run the qapp package command:

qapp package -p <package_name>

For example:

qapp package -p DNSDB_QRadarApp.zip

The command creates a new ZIP package in the current folder and confirms the result:

Created package DNSDB_QRadarApp.zip

Deploy the package to QRadar

QRadar exposes an application-creation API. Use it to create a new application from the package file.

Run the following curl command, substituting your own values:

curl -s -X POST --data-binary @<package_filename> --header \
    'Content-Type: application/zip' -u <qradar_username> -k \
    https://<qradar_console>/api/gui_app_framework/application_creation_task

<package_filename>: the file created by the qapp package command.
<qradar_username>: the username used to access QRadar, usually admin.
<qradar_console>: the IP address or hostname of the target QRadar instance.

The command prompts for the user’s password. If the package posts successfully, the response reports a status of creating. Note the application ID from the response — you need it for the next step:

{"application_id": <id>, "status": "CREATING"}

Check the creation status

Query the status of the creation task with a second call to the same endpoint, adding the application ID:

curl -s -X GET -u <qradar_username> -k \
    https://<qradar_console>/api/gui_app_framework/application_creation_task/<application_id>

<application_id>: the application ID from the previous response.

The command prompts for the password. When the application installs successfully, the status changes to COMPLETED:

{"application_id": <id>, "status": "COMPLETED"}

After this step, confirm that the application is running on the QRadar instance.

Export the app package

Once the app is installed and working as expected, export it from the QRadar instance. The exported ZIP is what you submit to the IBM App Exchange.

Find the content ID of the installed application with the content management tool:
```
/opt/qradar/bin/./contentManagement.pl -a search -c 100 -r Farsight
```
This lists every installed application whose name matches the regex Farsight. The output includes the content ID, name, and description, for example:
```
[INFO] Search results:
[INFO]     - [1010]  - [Farsight DNSDB]  - [Farsight DNSDB integration for IBM QRadar platform]
```
Note the content ID for the export step.

Export the application using that content ID:

/opt/qradar/bin/./contentManagement.pl -a export -c 100 -i <content_id>

When the script finishes, it saves a compressed application package in the folder you ran the command from and reports where:

[INFO] Export Summary:
[INFO]    Content Type - [Number of items exported]
[INFO]        - installed_application - [1]
[INFO]        - application_zip - [1]
[INFO] SUCCESS: Compressed exported bundle can be found here <export_path>

This is the package you submit to IBM after adding manifest.txt and signing the application.