Services involved in the integration of an event log
In the previous section, we learned how to ingest event logs. The journey of an event log from being pushed to or pulled by QRadar to it being parsed, and then correlated and stored is called the event pipeline. An event pipeline can be imagined as a constant array of upcoming events in QRadar.
Figure 4.1 – An event pipeline with the service segregation
The preceding diagram shows how the events from different log sources are integrated into QRadar using different QRadar services.
The different shapes on the left-hand side of Figure 4.1 suggest the different log sources, from where either the events are pushed by the log sources or pulled by QRadar. This depends on whether we use an active protocol or passive protocol. Protocols come under the ecs-ec-ingress service.
As we learned in Chapter 3, license that is required to collect and process the events. This license is the Events per Second...
