Configure IBM QRadar Connector

IBM QRadar® is a security intelligence platform that provides a unified architecture for integrating security information and event management solutions. Create a QRadar connector to send selected event data in QRadar LEEF format.

  1. In the BeyondInsight console, go to Configuration > General > Connectors.
  2. In the Connectors pane, click Create New Connector.
  3. Enter a name for the connector.
  1. Select IBM QRadar from the Connector Type list.
  2. Click Create Connector.
  3. Leave Active (yes) enabled.
  4. Provide the required details for the IBM QRadar server:
    • Select the protocol from the Available Output Pipelines list: TCP, TCP-SSL, or UDP.
    • Enter Host Name and Port.
  5. Select the formatter from the dropdown list.
    • LEEF Format V1 uses a static identifier per event type.
    • LEEF Format V2 uses a unique event identifier generated per event type.
  1. If you selected LEEF Format V2 in the previous step, select the Facility from the dropdown list. This option is not available for LEEF Format V1.
  2. Expand Event Filters, and then select the events that you want to forward.
  3. Click Test Connector to send a test event message.
  4. Click Create Connector.
Unique identifiers are preset, but can be customized if desired, using a setting in the BeyondInsight database table:

dbo.ConfigurationItem BeyondTrust.Configuration.ProductConfigurations.LeefFormatterConfig