IBM QRadar

Hi. We need to add EventIDs to Security Log filter on hundreds of Windows servers with Microsoft Windows Security Event log but we were unable to find this option. Does anyone know how can it be achieved?

Hi,

You can install this Windows content extension pack which gives you a lot of useful CEPs but the field that would be interested in would be EventID.

Once you have the CEP EventID, then you can use this CEP to filter out the events from your Microsoft Security Event log.

Windows Content Extension pack:

https://www.ibm.com/docs/en/qradar-common?topic=extensions-microsoft-windows

Hope it helps.

Hi,

This is a different case.

I ask whether is it possible to change Security log filter from all Log Sources we have currently at once, without modifying this parameter separately on each Log source?

I assume, using the API there should be an option to achieve this request..

Regards,

Ralph