Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.
Hello Everyone. Does anybody has a guide/experience how to integrate events from Apache installed on a Windows Server into QRadar? My first thought was to collect them with wincollect but the events get logged into C:\Apache\Xamp as far as i could find out.
Regards
Martin
Does the Application show up in the Event Viewer? If it does you can use it to create an XPath Query: https://www.ibm.com/support/pages/qradar-wincollect-how-use-microsoft-event-viewer-create-xpath-query. This will send the events to QRadar. You might still need to use an override to help parse the unknown events.
Hello CWolfson1,
thanks for the hint but the Application does not show up under "Create Custom View" - "By log" - "Event logs". Maybe this is due to it is not insalled as an Service. Any other ideas how to collect it? Maby grabbing the file that is stored under \Apache\Xamp?