IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Looking for Azure users

    Posted 06/19/19 04:19 AM

    I'd be interested to talk with anyone who's successfully collecting data from Azure event hubs. We are finding this a little tricky - not really the QRadar side, more on the Azure end. If you have information on any traps for the unwary, please do give me a shout!

    ------------------------------
    James McLaren Security Consultant and SIEM Specialist
    ------------------------------


  • 2.  RE: Looking for Azure users

    Posted 06/19/19 03:28 PM
    Edited by Patrick Routh 06/19/19 03:28 PM
    Hi James,

    If you have not seen these already, both of the below resources are a great place to start both on the QRadar protocol config side and the Azure Event Hub side.

    IBM Knowledge Center
    https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/t_dsm_guide_microsoft_azure_enable_event_hubs.html
    https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_logsource_Microsoft_Azure_Event_Hubs_protocol.html?cp=SS42VS_7.3.2

    Microsoft Documentation
    https://docs.microsoft.com/en-us/azure/event-hubs/
    https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-capture-enable-through-portal

    Slack
    The qradar-azure Slack channel is also a great place to connect with IBMers​ with Azure experience.

    ------------------------------
    Patrick Routh
    Offering Manager - QRadar Cloud Security
    ------------------------------



  • 3.  RE: Looking for Azure users

    Posted 06/20/19 03:36 AM
    Hi Patrick,

    Many thanks! I've seen and reviewed the IBM documentation but not the Microsoft, and it's the MS side where the problems are at the moment...

    Regards

    ------------------------------
    James McLaren Security Consultant and SIEM Specialist
    ------------------------------

    Original Message


Related Content