We had QRadar 7.5.0 Update Package 9(AIO). One LogSource supports TLS only therefore, we would like to opt for the TLS syslog solution.
LogSource expects three .pem files as:
1. Remote System log CA Certificate File
2. Remote System log Certificate file
3. Remote system log private key.
The above items are shared, and the configuration is done in QRadar as well:
Server Certificate Type: PEM Certificate and Private Key
But it's not working, here is the observations:
1. Test:
-
Initiating SSL handshake to [127.0.0.1:6514] with a timeout of 10000 Error: Unable to connect to host [127.0.0.1] on port [6514]: Received fatal alert: handshake_failure.
2. The pcap was collected in QRadar. I see that the Client Hello and Client Key Exchange requests were received, but QRadar has not responded.
I am wondering if any detailed MOP/Sample Config doc is available, or if someone can suggest.
Thanks.
------------------------------
Pawan Singh
------------------------------