I have an iOT app that sends events via syslog. There are 10,000 end points. Is it possible to have the log source identified by the App-Name string in the syslog header so that I would have one log source for my events rather than 10,000 separate ones?

Hi Mary,

Yes. You could setup a log source with Protocol Type=Syslog Redirect and define a regex and format string to capture the app name from the events as the "Source Name" - this is the value that gets tagged on the event payloads within the QRadar event pipeline and is used to route the event to the correct log source by matching this value to the Log Source Identifier. If all events captured that same app name value as the source name, they would all end up with the same log source.

But note that Syslog Redirect listeners have to listen on an alternate port (not 514), so you'll need to have the events point to that alternate port instead - hopefully you have a way of pushing out a bulk update to the endpoint config. If not, you could potentially use an iptables rule on the QRadar side to bounce the traffic from 514 to the alternate port.

Cheers

Colin

Super helpful. Thank you Colin.