IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  PingOne logs to QRadar

    Posted 06/09/22 09:59 AM
    Has anyone configured PingOne to send logs to QRadar? It is not supported by QRadar. 
    I am attempting to push subscription stream audit events to QRadar. The PingOne documentation states:
    "Enter the HTTP Authorization request header that will be posted to the URL you specified. For example, "Authorization:
    Basic 80F4FC1D78C0F15627C9B95C"." Do they need to use a QRadar token?
    https://docs.pingidentity.com/bundle/pingoneforenterprise/page/doz1564020498745-1.html


    ------------------------------
    LUIS LATAS
    ------------------------------


  • 2.  RE: PingOne logs to QRadar

    Posted 06/10/22 02:19 AM
    Hi Luis,

    We use poll method to collect  events from PingOne and leave all logs in a file of windows machine, for this, we use a powershell script with poll url that is executed every 5 minutes and collect the logs in a file, through qradar and log source ftps we read the logs of the file

    David Sanz

    ------------------------------
    DAVID SANZ POZAS
    ------------------------------



  • 3.  RE: PingOne logs to QRadar

    Posted 06/10/22 06:47 AM
    There is a Ping one section on the universal-dsm however I never tried it

    https://github.com/IBM/IBM-QRadar-Universal-Cloud-REST-API/tree/master/IBM%20Proof%20Of%20Concept/PingOne

    https://github.com/IBM/IBM-QRadar-Universal-Cloud-REST-API

    Al


    Original Message


Related Content