IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  TLS-Syslog Universal DSM Log Source Identifier Pattern for Windows Security Logs

    Posted 02/15/23 01:35 PM

    We set up an Universal DSM to accept TLS Syslog Windows Security events from two WinCollect 10 agents.  The traffic is now encrypted but we are struggling with the Log Source Identifier Pattern - the events are classified as "Unknown Generic Event" despite carrying a WindowsLog. 

    How do I write the regex needed for the Log Source Identifier Pattern so I can search events the log sources sent by these two agents?  The two links below have different guidance ($1 or \1; I am trying both, but nothing is coming through).  Also, where is the Event Retriever?



    Use As A Gateway Log Source 

    Set to On

    Log Source Identifier Pattern

    \1=([\w\d-]+)\.mydomain
    $1=([\w\d-]+)\.mydomain
    \1=<13>\w{3}\s\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s([\w\d-]+)\s
    $1=<13>\w{3}\s\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s([\w\d-]+)\s


    <13>Feb 15 10:03:50 LT-12345 AgentDevice=WindowsLog	AgentLogFile=Security	PluginVersion=WC.MSEVEN6.10.1.2.20	Source=Microsoft-Windows-Security-Auditing	Computer=LT-12345.mydomain.com ...




    https://www.ibm.com/docs/en/dsm?topic=options-tls-syslog-protocol-configuration

    Log source identifier pattern

    Thanks



    ------------------------------
    Tom L
    ------------------------------


  • 2.  RE: TLS-Syslog Universal DSM Log Source Identifier Pattern for Windows Security Logs

    Posted 02/24/23 06:02 PM

    I believe that generically, you should be able to use this $1=COMPUTERNAME=\"(.*?)\" as your Log Source Identifier. Computername is a pretty standard field in the payload and should capture the full value. 



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------



  • 3.  RE: TLS-Syslog Universal DSM Log Source Identifier Pattern for Windows Security Logs

    Posted 02/28/23 06:30 PM

    Thanks Jonathan, unfortunately I'm not seeing any new log sources created based on that pattern.  Do you know where to find the Event Retriever to help troubleshoot?



    ------------------------------
    Tom L
    ------------------------------

    Original Message


  • 4.  RE: TLS-Syslog Universal DSM Log Source Identifier Pattern for Windows Security Logs

    Posted 03/27/23 12:56 PM

    A knowledgeable IBM technician identified the problem - the ecs-ec service needed a restart.  Now my standalone WinCollect 10 agents have their own log source in the QRadar Log Source Management.



    ------------------------------
    Tom L
    ------------------------------

    Original Message


Related Content