Exploring protocols and DSMs
There are two factors we need to consider when integrating event data in QRadar:
- How to transfer data from end devices to QRadar
- How to parse or make sense of data that is received
Let’s look at each of these considerations in detail.
How to transfer data from applications to QRadar
Different applications can be installed and run on different platforms or operating systems. For example, while some applications could be on a Windows machine on a bare-metal server, other applications could be running on the AWS cloud or some security appliance, such as a Ciscofirewall deployed in your organization.
All these endpoints are known as log sources, as we receive log data from them. As the log sources are on different platforms, they might also use different technologies and ways to log the data. For example, the AWS log sources can use something such as a S3 bucket, while a Linux security log would be saved on the same Linux...
