Leaving No Data Behind

In the previous chapter, we learned how event data is collected and consumed by QRadar. We learned that protocols are needed to collect data while Device Support Modules (DSMs) are required to parse data. Consider a scenario where we want to ingest event data into QRadar but there is no supported DSM. The first thing is to know what the supported DSMs are.

Every month, IBM releases a new DSM guide, a document on how to integrate log sources with QRadar. If your log source is not a part of this DSM guide, then the event data ingested is either categorized as Stored or Unknown. The event data is not parsed. That does not help us with correlation when it comes to matching events with rules. So, whatever event data we are ingesting in QRadar should be parsed properly.

Using a tool called DSM Editor, we can create custom parsers for any type of data that is ingested in QRadar. In this chapter, we will discuss the steps to create custom parsers in QRadar in detail...