Send logs to IBM QRadar

You can send the logs of a stream to IBM QRadar from Azion Console or with the Azion API. To send the events of a Web Application Firewall to a SIEM instead of the requests of your applications, refer to Stream WAF events to a SIEM.

Data Stream sends each batch of log lines to a URL of your QRadar instance. The URL is the only setting of this endpoint, with no key or token to enter. The stream form sets the endpoint in the field labeled Connector, where QRadar is the IBM QRadar option. For the field and its bounds, refer to Endpoints.

This guide streams the requests of one workload through the Applications data source.

Prerequisites

Console

An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
A workload on the account that receives requests.
Access to your IBM QRadar instance, to get the URL that receives the log lines.
That URL, with its scheme, such as https://qradar.example.com:14440.
Access to Azion Console. To sign in, refer to How to access Azion Console.

Create the stream

The stream takes its logs from one workload, through a workload filter. Sampling would deactivate your other streams; a workload filter does not.

Console

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream

Name the stream

In the General section, enter a Name. For example: logs-to-qradar.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. Select your workload in Available Workload, then use the arrow to move it to Chosen Workload. If your Console names domains where this guide names workloads, the same control reads Filter Domains. The pick list then reads Available Domain and Chosen Domain.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the QRadar endpoint

In the Output section, select IBM QRadar in Connector.

Enter the QRadar URL

In URL, enter the URL of your QRadar instance. For example: https://qradar.example.com:14440.

Keep the stream active

In the Status section, leave Active on.

Select Save

The Console confirms with Your data stream has been created. In the Data Stream list, the stream shows QRadar in the Connector column and the Active status.

Azion saves the stream without a call to the QRadar URL. A wrong URL shows only when the stream sends. The activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events keeps a record of each send of a stream, delivered or not, with the status code that the endpoint returned. Send a few requests to the workload and wait about one minute. A stream sends a batch every 60 seconds, or earlier when the batch reaches 2,000 log lines.

Console

To read the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source

Find the QRadar sends

Each row is one send. Look for QRADAR in Endpoint Type, and read the Status Code of those rows.

A 200 in Status Code means QRadar accepted the batch. Streamed Lines shows how many log lines the batch held.

A status other than 200 comes from QRadar, except 503: that status means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsThe URL field of the IBM QRadar endpoint, with its type and API name.Stream WAF events to a SIEMSend the events of a Web Application Firewall to QRadar or another SIEM.Edit, stop, or delete a streamChange the QRadar URL, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.