IBM Security QRadar

 View Only

  • 1.  Do Disabled Log Sources Count Towards EPS?

    Posted Thu November 17, 2022 10:38 AM
    Do disabled log sources count towards EPS? We have a lot of log sources that we've labeled as misdetections to lower the amount of EPS over our data gateways. We disable all of the misdetections, but we're still running in to some issues with our gateways being overloaded. 

    Is anyone familiar with this?

    Thanks

    ------------------------------
    Aaron Gallardo
    ------------------------------


  • 2.  RE: Do Disabled Log Sources Count Towards EPS?

    Posted Thu November 17, 2022 11:36 AM
    Depends on protocol. Passive protocols like syslog the datagateways
    will still be 'getting logs', where APi and JDBC for example will not.


    Original Message


  • 3.  RE: Do Disabled Log Sources Count Towards EPS?

    Posted Tue November 22, 2022 02:44 PM
    As a general rule, if you can see the events in Log Activity, even if they're being routed to the SIM Generic Log source because the log source that is supposed to process them is disabled, that means they're counting towards your EPS license. As hostcontext restart said, if you disable a log source attached to an active/outbound protocol, that will disable the protocol config and thus stop events from being ingested at all, but if they're being pushed to QRadar and consumed via a passive/inbound protocol like syslog then they still come into the system whether the log source that was parsing them is enabled or not. In such cases you'd need to change the config on the sending side to stop sending events to your Data Gateway.

    Cheers
    Colin

    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------

    Original Message


  • 4.  RE: Do Disabled Log Sources Count Towards EPS?

    Posted Wed November 23, 2022 01:59 AM

    If you really don't want these logs but can not avoid the logs coming in, then use "routing rules" to drop the traffic from these sources.

    Traffic dropped in this way will is no longer processed or stored and will be counted as licensegiveback.

    Your reported EPS numbers will still be the same, but EPS counted against your license is reduced by the licensegiveback numbers.

    https://www.ibm.com/support/pages/qradar-license-eps-rates-and-giveback

    Regards

    Thomasd



    ------------------------------
    SIEM-2020
    ------------------------------

    Original Message