Dear Team,

did anyone mange to add ManageEngine to QRADAR SIEM? as it unsupported 

thanks

Hi Youssef,

I haven't personally integrated ManageEngine EventLog Analyzer with QRadar, but in general, unsupported log sources can often be onboarded if they can send events in a format that QRadar can receive and parse.

A few questions:

• Is EventLog Analyzer able to forward events via Syslog?
• What format are the events being sent in (raw Syslog, CEF, JSON, etc.)?
• Are the logs reaching QRadar but showing as Unknown Events, or are they not being received at all?

If the events are reaching QRadar, you may be able to use a Universal DSM or create custom parsing and event mappings using DSM Editor.

If you can share a sample log, it would be easier for the community to determine the best integration approach.

Thanks.

Hi Yussef 

It should be easly integrated through syslog

Logs are not too bad to parse with custom DSM

Regards

Stefano