1. In the Zscaler ITDR Admin Portal, go to Orchestrate > SIEM Integrations.

2. Click Add Integration, and select IBM QRadar from the drop-down menu.

   See image.

   

   Close

3. In the QRadar Details window:

   • Name: Enter a name for the QRadar SIEM integration.
   • Enabled: Select to enable SIEM integration.
   • Service Connector: Select a Service Connector from the drop-down menu. If you select a Service Connector that is configured in the ITDR Admin Portal, the portal sends logs to QRadar.
   • Type of logs: Select an option from the drop-down menu.
     • Events: Send events to QRadar.
     • Audit Logs: Send audit logs to QRadar.
   • Include Safe Events: Enable to forward the events that are marked as safe to QRadar.

   • Filter: Specify a query if you want to send filtered event logs to QRadar. If this field is blank, all event logs are sent to QRadar.

     The Filter option is available only for event logs.

   • Host: Enter the QRadar server IP address.
   • Port: Enter the port number the QRadar server is listening to.
   • Transport: Select TCP or UDP.
   • Facility: Select a facility code (e.g., User) from the drop-down menu. Each event is labeled with a facility code, indicating the type of software generating the event logs.
   • Severity: Select a severity level (e.g., Debug) from the drop-down menu. Each event is labeled with a severity, indicating the severity of the tool generating the event logs.
   • App Name: Enter a log identifier (e.g., Zscaler ITDR).

   See image.

   

   Close

4. Click Save.

   The QRadar SIEM integration is added.

1. Open an IBM QRadar SIEM console.
2. Go to Admin > DSM Editor.
3. In the Select Log Source Type window, click Create New.
4. Under Log Source Type Name, enter a name for the log source type.
5. Click Save.
6. Select the log source that you created and map the event fields with the help of raw logs. To learn more about event mapping, refer to the IBM documentation.

1. Go to Admin > Log Source Extension.
2. Click Add.
3. In the Add Log Source Extension window:
   • Enter the name of the log source extension.
   • Enter the description of the log source extension.
   • Select the log source type that you created.
4. Click Save.

1. Go to Admin > Data Sources > Events.
2. Click Log Sources > Add.
3. In the Add a log source window:
   • Log Source Name: Enter a name for log source.
   • Log Source Description: Enter a description for the log source.
   • Log Source Type: Select the log source type you created from the drop-down menu.
   • Protocol Configuration: Select Syslog from the drop-down menu.
   • Log Source Identifier: Enter service-connector.
   • Enabled: Select this checkbox to enable log source.
4. Click Save.
5. Go to the Admin page, and click Deploy Changes to activate the new log source.

To test the QRadar SIEM integration, generate events on the Investigate page. The QRadar console starts receiving logs.