Hi,

I am seeking for a method to extract periodically the logs source mounted in auto discovery. It could be a psql or aql request or may be another way.

My objectif is to be informed with the logs source reached in autodiscovery

Normally we can find the list of log source without group by sending a psql request, something like :

psql -U qradar -c "select hostname, devicename from sensordevice where group is null and deviceenabled is true;"

this request evidently doesn't work and it need more development ! can you help me please to find the correct psql request ?

Best regards

Hi,

maybe this is a matrix for your solution:

select QIDNAME(qid) as 'Event Name',logsourcename(logSourceId) as 'Log Source',"eventCount" as 'Event Count',"startTime" as 'Time',categoryname(category) as 'Low Level Category',"sourceIP" as 'Source IP',"sourcePort" as 'Source Port',"destinationIP" as 'Destination IP',"destinationPort" as 'Destination Port',"userName" as 'Username',"magnitude" as 'Magnitude' from events where ( "deviceGroupList"='0' AND qid='28250053' ) order by "startTime" desc last 24 hours

Regards,

Ralph