Connect KSC with SIEM (IBM QRadar)

[Tahmeed702]

I wanna export logs to my IBM Qradar SIEM solution in LEEF format , how to configure in KSC to connect with SIEM and how to configure connection in SIEM to integrate with KSC , can anyone explain in details. I am beginner in SIEM and KSC

[Diego Moraes]

Hello,

Documentation for export is here.

https://support.kaspersky.com/KSC/14.2/en-US/151328.htm

Here is a step by step explanation of how to do this.

 

[Tahmeed702]

On 12/12/2024 at 6:11 PM, Diego Moraes said:

Hello,

Documentation for export is here.

https://support.kaspersky.com/KSC/14.2/en-US/151328.htm

Here is a step by step explanation of how to do this.

 

This Only explains the connection settings in KSC , but how can i set specific port number in IBM so that KSC can send logs to IBM Qradar . I have deployed IBM Qradar In my VM.

 

[Tahmeed702]

I tried to connect IBM Qradar Via syslog but got following errors.

[Diego Moraes]

Hello, according to the documentation, you need to select the qradar protocol (LEEF format), not syslog, as you selected.

Read the documentation here https://support.kaspersky.com/KSC/14.2/en-US/151330.htm