Forum Discussion
AltostratusQradar & F5 LTM/ASM logs
Morning all, Does anyone have any experience in troubleshooting the logs going through a QRadar SIEM installation?
At the moment, the QR installation is not logging the ASM properly. It doesnt include the payload or the correct event tag. QR thinks that the ASM is actually a Fortinet device.
Is there any documentation that could guide us here?
To be honest, we are not even sure where to start TIA
Richard_KaronEmployee
First make sure the log traffic is being sent from the BipIP by using a tcpdump to collect traffic. Then verify that it is making it to the SIEM using the SIEM specific traffic analysis.
If this is occuring, then this sounds like a mismatch between the format being sent and what the SIEM is set up to accept.
Specific to QRADAR, here is a DSM Guide that talks about accepting various formats. http://public.dhe.ibm.com/software/security/products/qradar/documents/iTeam_addendum/b_dsm_guide.pdf