IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Ingesting PowerShell logs

    Posted Mon December 09, 2019 08:38 PM
    ​Hi All,
        Has anyone managed to get PowerShell logs ingested into QRadar and parsed properly etc?
    One of our customers is keen on getting these logs into the SIEM and we are trying to work through the best way to go about it.
    The customer wants to set-up a custom view within AD to just display the events he is interested in and is then hoping that the WinCollect agent already on the box can be configured to collect the logs matching the view. I'm not sure that its possible to do using WinCollect (installed in unmanaged mode).

    Appreciate any ideas.

    Thanks
    Brian

    ------------------------------
    Brian Robertson
    ------------------------------


  • 2.  RE: Ingesting PowerShell logs

    Posted Tue December 10, 2019 04:24 AM
    Hunt around EventViewer on the source of your Powershell events (Applications and Services Logs / Windows PowerShell)

    Filter in/out the events you require but as a base you should be looking at 

    <QueryList>
    <Query Id="0" Path="Windows PowerShell">
    <Select Path="Windows PowerShell">*</Select>
    </Query>
    </QueryList>

    Usually for a managed install you would add your Xpath to the Log source for the server in the XPath Query box

    For an unmanaged install your going to need to get creative and implement this via the WinCollect installer

    https://www.ibm.com/community/qradar/2019/03/14/wincollect-7-2-8-stand-alone-cmd-line-with-xpath-option/


    Good luck and keep us posted.

    ------------------------------
    JH
    ------------------------------

    Original Message