IBM QRadar

 View Only

 Log source for unknown event names

Nizan Cohen's profile image
Nizan Cohen posted 02/17/25 10:27 AM

Hello!

I'm receiving events from LogStash. Their team is refusing to name the system that are being sent to my QRADAR and it makes a mess since it's one Log Source Identifier.

I tried to play with the parsing order which made all mess to go to the last log source in that list.

So, I was wondering, is it possible to create a log source, connect the identifier to it, and somehow get all unknown event names into it for future investigation to find which system they are belong?

To make things alittle easier, the relevant systems are getting their logs accordingly. I put an event category with piece of information that all of them has. The last log source in the order, gets it's own PLUS all rest of the events.

So, new log source, same identifier.

If that would work, what should I put in the "event category" and "event name" parsing? 

Would such solution work?

John Dawson's profile image
John Dawson posted 02/17/25 11:17 AM

Hi Nizan

The following document may be of use to you.  Unknown events are routed to teh SIMGenric logsource

https://www.ibm.com/docs/en/qradar-on-cloud?topic=problems-troubleshooting-dsms

Thanks

Nizan Cohen's profile image
Nizan Cohen posted 02/18/25 02:29 AM

Hi John. 

They're not going to Generic because they have an identifier (i think).

They're going to the last log source in the order in "parsing ordering".

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted 02/18/25 04:23 AM

If you can find in the payload anything that could serve as unique identifier for the source system, you might be able to make use of syslog redirect connector.

https://www.ibm.com/docs/en/security-qradar/security-qradar-siem/saas?topic=configuration-syslog-redirect-connector-options

https://www.ibm.com/support/pages/qradar-syslog-redirect-protocol-faq

However, bear this note in mind in case the EPS rate is high ("The Syslog Redirect protocol is a single-threaded process"[...]"This protocol is not intended to be used to parse all incoming events sent to a QRadar appliance")

Related Content