Skip to main content

Site CollectorSite Collector Administration Guide

Set Up IBM Security QRadar Collector

If you use IBM QRadar as a SIEM, you can set up the IBM Security QRadar collector to retrieve logs from your IBM Security QRadar server. The IBM Security QRadar collector is a set of Site Collector flows, pre-built processors, groups, custom processors, other components, and integrations that pull logs in plain text or JSON format from your IBM Security QRadar server and push the logs to Exabeam Security Operations Platform.

Before setting up the collector, ensure that you have Site Collectors' version 2.0 and above.

To set up a IBM Security QRadar collector:

  1. Log in to the Exabeam Security Operations Platform with your registered credentials.

  2. Navigate to Collectors > Site Collectors.

  3. Ensure that Site Collector 1.6 or a later version is installed and in running state.

  4. On the Site Collector page, click the Collectors Library tab, then click IBM Security QRadar.

    Linux_file_collector1.png
  5. In the Definition section, enter the required information as follows.

    IBM_Security_QRadar_1_1.png
    • Collector Name – Specify a name for the IBM Security QRadar collector.

      Note

      Ensure that you specify different names for Site Collector instance and the collector.

    • Site Collector Instance – Select the site collector instance for which you want to set up the IBM Security QRadar collector. You can select the site collector instances that belong to Site Collectors 1.16 and later version.

    • QRadar IP – Enter the IP address of the QRadar server from which you want the QRadar collector to pull logs.

  6. Click Next.

  7. In the Authentication section, enter the required information as follows.

    IBM_Security_QRadar_2_2.png
    • Authentication – Select the authentication method Login Pass or Token for the IBM Security QRadar collector to connect to the sever.

      • If you select the authentication method Login Pass, enter the user name and password.

        • Username – Enter the login name and password that you already set for the IBM Security QRadar server.

        • Password – Enter the login name and password that you already set for the IBM Security QRadar server.

      • If you select the authentication method Token, enter the token value that you generated from your QRadar server by adding an Authorized Service in QRadar with a user role All. For more information, see Creating an authentication token in the IBM documentation.

        QRadar_token.png
  8. In the Data section, enter the required information as follows.

    Data_section_updates_QRadar_where_column.png
    • Custom Columns – Enter the column names separated by comma. For example: sourceip,destinationip. Ensure that you exclude the default column names: playload, deviceTime, and startTime for which the collector pulls logs automatically.

    • QRadar Fetch Timestamp – Select the time and date from when you want the collector to fetch logs. By default current date and time is selected. If you want to select a threshold to include events to be ingested from the past, select a date previous to the present date. You can select a date which is backdated to 30 days.

    • Where Conditions – Enter the where clause conditions to filter logs to be collected. For more information, see WHERE clause in the IBM documentation.

  9. Click Setup.

    The IBM Security QRadar collector is set up and is ready to pull logs from your QRadar server.

    After the QRadar collector is set up, Site Collector Core starts pulling logs real-time and uploads logs to Exabeam Security Operations Platform. If the QRadar server is not available, Site Collector core resumes pulling logs from the place where it stopped. Site Collector supports the following three types of logs out of the various types of logs supported by the QRadar server.

    • Plain text (Syslog one-line events)

    • JSON (one-line JSONs)

    In case of installation failure, the collector is disabled, and the configuration is saved. The status of the collector can be checked on the UI or using the support package.