IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Logs from SQLite and SQLPlus

    Posted 07/11/19 05:26 PM
    Hi
    Does someone know or sometime had integrate SQLite and SQLPlus with Qradar?
    I would like to know, if there some way to do it, how to integrate those two sources to Qradar.
    I been searching information and didn't find nothing about yet.
    Thanks

    ------------------------------
    Johan López
    ------------------------------


  • 2.  RE: Logs from SQLite and SQLPlus

    Posted 07/11/19 11:39 PM
    Hi Johan,

    you need to refer to the DSM Guide to see if your system is already integrated in Qradar.
    ftp://ftp.software.ibm.com/software/security/products/qradar/documents/iTeam_addendum/b_dsm_guide.pdf

    If it's not there, then you can ask IBM to create the DSM for you in a feature request RFE.
    https://www-01.ibm.com/support/docview.wss?uid=swg22016126

    Or like most of us, you'll need to manually parse your data. You can use the DSM Editor to extract all the info you need from your logs, or create a Log source extension. These technics are explained in the DSM guide. If you need more details, IBM provides some free training session on their security learning academy website. 
    https://www.securitylearningacademy.com/
    Sort on Qradar trainings, and you'll find the topics I mentionned, thus dsm editor and log source extension (LSX).

    Good Luck!

    ------------------------------
    Anthony Gayadeen, Videotron Ltd
    Montreal QC
    ------------------------------



Related Content