Based on direct customer requests, QRadar now supports Salesforce External Client Apps, with Client Credentials Flow available as an authentication option for Salesforce Security log sources.
When configuring a Salesforce Security log source, customers can now choose the authentication method that matches their application:
Existing Connected App customers can continue using Password Authentication with no changes required. This enhancement also helps customers prepare for the broader industry transition away from the Username-Password OAuth flow toward Client Credentials Flow.
For overall QRadar deployment stability and optimal performance across both the event pipeline and search, it is important to ensure that raw events are assigned to the correct log source type for parsing. Correcting events that are assigned to the wrong log source type is one of the best regular tuning exercises to improve the health of the entire SIEM, not just parsing.
Below is a quick way to identify these types of events and address them.
In the AQL query below, we will use the Stored for Performance flag. Combined with the Unknown/Stored category filter, this will display all events from which an event ID and category cannot be extracted by the log source type with which the event is currently associated.
1. Run this AQL query in the log activity tab. The time range can be adjusted to cover a larger time frame or specific time frame.
SELECT logsourcename(logSourceId) AS 'Log Source', SUM("eventCount") AS 'Event Count (Sum)', UniqueCount("collectorId") AS 'Event Collector (Unique Count)', UniqueCount(category) AS 'Low Level Category (Unique Count)', COUNT(*) AS 'Count' from events where ( category='10009' AND "storedForPerformance"='false' ) GROUP BY logSourceId order by "Count" desc last 60 minutes.
2. Review the top few log sources by opening the events and reviewing the payloads to see if they make sense for that log source type. Reference the DSM Guide if you are unsure whether the raw event structure is correct. One thing that can be helpful is testing these event payloads in the DSM Editor, either by selecting the events from Log Activity or by pasting the payload into the DSM Editor. From there, you can change the log source type to see if an event ID and category can be parsed out.
3. If there is a log source type that is not used in the deployment, one of the best things to do is turn off auto-discovery in the DSM Editor under the Configuration tab. To preserve the performance of the SIEM, if a whole log source is not useful or tracking down the proper type will take time, disabling the log source is a great step. The events will be sent to the SIM Generic Log Source Type and will bypass any parsing logic. This will improve performance in the meantime, and the events can still be searched with Quick Filter within the retention period.
INNOVATION SPOTLIGHT - WE WANT YOUR INPUT
Can Your SIEM Tell You Where Quantum Risk Lives in Your Network?
By Declan McNamara | IBM Security
NIST finalized its first post-quantum cryptography (PQC) standards in 2024. For most security teams, that shifted the question from “should we prepare?” to “where do we start?” - and most don't have a live picture of which cryptographic algorithms are actually in use across their network. Certificate scanners show what's configured, not what's negotiated, which means cryptographic inventory is incomplete by definition.
We're in the discovery phase of building the IBM QRadar Quantum Risk Insights App - a native app that would use QRadar Network Insights to inspect cryptographic metadata in live TLS, SSH, and RDP traffic, without decrypting payloads, and surface quantum-vulnerable algorithms as dedicated, fully contextualized offenses.
Security analysts - triage-ready views of the most exposed assets and protocols, with drill-down to flow data.
CISOs - trend dashboards and a readiness scorecard to track migration progress and report to the board.
|
We're at the stage where customer input has the most influence on what gets built. If your organization is working through PQC planning, we want your view on three things:
UPCOMING EVENTS & WEBINARS
Mark Your Calendar
|
|
IBM QRadar Monthly - Upcoming New Features, Roadmap & Demo
Live webinar · 10 AM to 11 AM (ET)
|
Quick Links
- IBM Training - to build and strengthen your cybersecurity skills