Hello Experts,

I am trying to integrate a Blue Coat proxy device to QRadar, but i observed that the low level category on the log activity tab is "stored".

Checking the payload i noticed the encrypted format, on the log source i have configured a text file format. and the raw data is a name value pair with delimiter as "=", and delimiter separator is "|". On QRadar, the blue coat DSM parser was configured as name value pair, delimiter as "=", and delimiter separator as "|". 


------------------------------
benjamin Nworah
------------------------------

Screen shot

------------------------------
benjamin Nworah
------------------------------

Hi Benjamin,

Have you checked (or tested) that the Bluecoat is (or isn't) actually sending it as encrypted/encrypted payload in the first place?

Not got a BlueCoat here to check, but a quick look on log source manager for the two supported Bluecoat appliances, has no options for decrypting an encrypted payload. So the source will need to be plain text payload if you want the DSM to parse it. 


------------------------------
Darren H.
------------------------------

Original Message:
Sent: Tue February 09, 2021 07:18 AM
From: benjamin Nworah
Subject: Payload in encrypted format

Screen shot

------------------------------
benjamin Nworah
------------------------------

Benjamin,

It looks like you have the wrong "Encoding" in the LS definition.

The default is UTF-8, I'd try the others until you get a sensible payload.

Paul

------------------------------
Paul Leonard
------------------------------

Benjamin,

It looks like you have an inappropriate "Encoding" parameter value in the Log Source definition. 

The default is UTF-8, which works fine for most cases, but there are other possibilities. Try each one (just start at the top) and observe subsequent payload displays. When you find the correct value, the payload will "look like" readable text & you'll be good-to-go.

Paul

------------------------------
Paul Leonard
------------------------------