topic Re: Forwarding data to Qradar using syslog from HF in Getting Data In

Forwarding data to Qradar using syslog from HF

KhalidAlharthi — Sun, 09 Jun 2024 13:52:52 GMT

Hello Community,

i have forwarded the data for trend micro to another third-party SIEM (Qradar) using HF those the configuration i did

# props.conf

[source::udp:1411]
TRANSFORMS-send_tmao_route = send_tmao_to_remote_siem 

# transforms.conf

[send_tmao_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem

# outputs.conf

[syslog:remote_siem]
server = remotesiem:1234
sendCookedData = false

i have recieved the data by using tcpdump and packets are coming from HF to the third-party system

but there are not appear in the SIEM why is that any help ...?

Re: Forwarding data to Qradar using syslog from HF

tscroggins — Sun, 09 Jun 2024 15:23:42 GMT

Hi @KhalidAlharthi,

If QRadar is receiving but not processing the data, you should probably contact IBM support. If IBM indicates the data is not in the correct format, the community can help with transforming the output on the Splunk side. (See my response to your previous question.)

Re: Forwarding data to Qradar using syslog from HF

KhalidAlharthi — Sun, 09 Jun 2024 15:33:31 GMT

@tscroggins Thank you for your reply and help

i managed to forward the logs to linux server just to test the functionality and it's working fine i receieved the packets correctly in raw formats is there a possibility to route the data to another system with parsing of splunk i think this should be done from splunk indexers ..

Re: Forwarding data to Qradar using syslog from HF

gcusello — Sun, 09 Jun 2024 16:07:59 GMT

Hi @KhalidAlharthi ,

let me understand:

your fork is forwarding syslogs to the third party but not to Splunk, is it correct?

have you a defaultGroup in outputs.conf?

if yes, try to remove it.

Ciao.

Giuseppe

Re: Forwarding data to Qradar using syslog from HF

KhalidAlharthi — Mon, 10 Jun 2024 06:48:56 GMT

that's my outputs.conf

[syslog]
defaultGroup = group2

[syslog:remote_siem]
server = xx.xx.xx.xx:514
sendCookedData = false

Re: Forwarding data to Qradar using syslog from HF

gcusello — Mon, 10 Jun 2024 09:50:13 GMT

Hi @KhalidAlharthi ,

did you trid to remove defaultGroup?

Ciao.

Giuseppe