IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Issue with Log Source

    Posted 03/15/21 03:52 PM

    I have an issue with Log Sources.

    I’ve created some log sources via Log Source Management and then deleted them from there

    My trouble is that they are absent on LS Management but still appeared on Qradar server when I execute

    contentManagement.pl -a search -r .* -c 17

    How can I totally remove them from the system ?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Issue with Log Source

    Posted 03/16/21 04:18 AM

    Hello,

    When you delete a Log Source from UI, the attributes for Log Source entry in the database change from enabled to disabled. It is NOT deleted in database but is just disabled.

    There is no supported way to delete Log Source from database.

    Saying this, you can still achieve what you are looking for. You can download the app called - Log Source Management app from QRadar App Exchange : The IBM Security QRadar Log Source Management app is a new, completely redesigned interface for viewing, creating, editing and deleting log sources :

    https://exchange.xforce.ibmcloud.com/hub/extension/8169c48dc992961acb8f963cdcf56faa

    From this app, you can select few or all log sources (various filters are all available) and directly 'Download' the information regarding the Log Sources from it.

    Thanks!

    Ashish Kothekar



    #QRadar
    #Support
    #SupportMigration


Related Content