Forwarding data to Qradar using syslog from HF

[KhalidAlharthi]

Hello Community,

i have forwarded the data for trend micro to another third-party SIEM (Qradar) using HF those the configuration i did 

# props.conf

[source::udp:1411]
TRANSFORMS-send_tmao_route = send_tmao_to_remote_siem 

# transforms.conf

[send_tmao_to_remote_siem]
REGEX = .
SOURCE_KEY = _MetaData:Index
DEST_KEY = _SYSLOG_ROUTING
FORMAT = remote_siem

# outputs.conf

[syslog:remote_siem]
server = remotesiem:1234
sendCookedData = false

 i have recieved the data by using tcpdump and packets are coming from HF to the third-party system

but there are not appear in the SIEM why is that any help ...?

[gcusello]

Hi @KhalidAlharthi ,

let me understand:

your fork is forwarding syslogs to the third party but not to Splunk, is it correct?

have you a defaultGroup in outputs.conf?

if yes, try to remove it.

Ciao.

Giuseppe

[KhalidAlharthi]

that's my outputs.conf 

[syslog]
defaultGroup = group2

[syslog:remote_siem]
server = xx.xx.xx.xx:514
sendCookedData = false

[gcusello]

Hi @KhalidAlharthi ,

did you trid to remove defaultGroup?

Ciao.

Giuseppe

[tscroggins]

Hi @KhalidAlharthi,

If QRadar is receiving but not processing the data, you should probably contact IBM support. If IBM indicates the data is not in the correct format, the community can help with transforming the output on the Splunk side. (See my response to your previous question.)

[KhalidAlharthi]

@tscroggins Thank you for your reply and help

i managed to forward the logs to linux server just to test the functionality and it's working fine i receieved the packets correctly in raw formats is there a possibility to route the data to another system with parsing of splunk i think this should be done from splunk indexers ..