IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Configuring Log Source

    Posted 06/05/26 10:59 AM

    Hi,

    I'm working on onboarding a Lantronix device that is sending syslog events (UDP 514) to QRadar, and I wanted to check how others have handled log source identification for similar setups. I still see events under "Unknown Generic Event".  Any suggestions? 
    <84>Oct  9 18:48:18 dropbear[24890]: Bad password attempt for 'root' from <IP>:53516


    ------------------------------
    Langston Menezes
    ------------------------------


  • 2.  RE: Configuring Log Source

    Posted 06/09/26 01:53 PM

    If your Lantronix device is sending syslog (UDP 514) to QRadar but events are appearing as "Unknown Generic Event", it usually means QRadar is receiving the logs but cannot properly identify the log source type or parse the event payload.

    Here are the areas I would check:

    1. Verify the Log Source Identifier
    Create or review the log source and set the identifier to:
    • The Lantronix device IP address, or
    • The sending hostname (if you can configure one)
    For devices that do not send a hostname, using the source IP is often the most reliable option.

    2. Check the DSM Type
    Instead of relying on auto-discovery, try manually creating a log source such as:
    • Linux OS
    • Unix OS
    • Universal DSM
    • Syslog Redirect
    The exact choice depends on what the rest of the Lantronix logs look like.

    3. Review More Sample Events
    One event is not enough to determine whether QRadar can identify the source. I'd want to see:
    • Authentication failures
    • Successful logins
    • System events
    • Network/service events
    Sometimes QRadar only identifies a device after seeing a broader set of messages.


    ------------------------------
    Allan Solomon Mejia
    ------------------------------



  • 3.  RE: Configuring Log Source

    Posted 06/10/26 02:10 PM

    thanks Allan- i will look into this



    ------------------------------
    Langston Menezes
    ------------------------------

    Original Message


  • 4.  RE: Configuring Log Source

    Posted 06/09/26 01:53 PM

    The issue is most root systems now have been secured a little more tightly, so the initial solution people have been using to print(log[source]) has not been running well. If you are using any device that is connected through a company check with them before moving forward. The might have the admin privileges to allow you to do so, however with certain OS like MAC, Win11, and Android, the default root printing privileges are revoked until further notice. There has been to many issues of people disguising logs or analysis files for system takeover pieces. I'm sure that issue will sort itself out in the coming days.



    ------------------------------
    Deverick Whitfield
    Lead mobile device and CLoud Designer
    AT&T Services Inc.
    Galveston TX
    2816909504
    ------------------------------



  • 5.  RE: Configuring Log Source

    Posted 06/10/26 09:35 AM

    Hi Langston,

    I'll just add to Allan's good answer. That sample event you provided doesn't include an RFC-compliant syslog header, meaning QRadar won't be able to extract the Log Source Identifier from the event text, it will instead use the IP address that the UDP datagram came from.

    So if you have manually created a log source for this Lantronix device, ensure the Log Source Identifier in your log source config, matches the Log Source Identifier field in the details view of one of the Lantronix events appearing as Unknown Generic (it's near the bottom, 3rd field up above the Identity Information), this should be the IP of the Lantronix device.

    Once the Log Source Identifier is set correctly, the events should be routed to your log source. Whether they parse correctly or not depends on what the other events look like and what Log Source Type you select. There is no Lantronix DSM (Device Support Module, which is the code which backs an IBM_provided log source type) officially supported by IBM, so you can either make your own custom log source type for it using the DSM Editor, or it's possible an existing log source type may be similar enough that it can handle the events. That sample you provided looks kind of like something the Linux OS type can handle so if the Lantronix OS is a Linux clone then that log source type might work, but then again it may not and you may need to build your own.

    Once you have a log source type which can successfully parse the events, as long as Log Source Autodetection is enabled for the type in the Configuration tab of the DSM Editor, if you have additional Lantronix devices to onboard, you should be able to just point their syslog feeds at QRadar and it will autodetect them, but I'd start with manually configuring one to ensure it parses correctly before relying on autodetection, as it only works if there's a DSM on the system that can recognize the events.

    Cheers

    Colin



    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------



Related Content