Summary
Leaving no data behind is based on the military concept of no man left behind. With QRadar, we have taken utmost care to ensure that no data is dropped under any circumstances (except more events being sent to QRadar than the licensed amount). To do this, we have introduced the concepts of queues, buffers, and so on. We have also created a tool called DSM Editor to parse unsupported log sources. This chapter will help you ingest any types of logs that are generated in your environment. Whether these logs are based on applications, custom operating systems, or Internet of Things (IoT) devices, you will be well aware of how to use log data for ingestion.
In the next chapter, we will talk more about data and how it is to be searched. We will cover the fundamentals of searches and how to optimize searches.