topic Re: can we send bro ids log to qradar Ibm? in General Topics

can we send bro ids log to qradar Ibm?

ALPHADA — Fri, 04 May 2018 16:59:12 GMT

hello every body , i have a project when i shall send the bro ids log to qradar Siem ,i want to know if it is possible or not

Re: can we send bro ids log to qradar Ibm?

OtakarKlier — Fri, 04 May 2018 18:48:04 GMT

Hello,

So both bro and PAN can sernd logs to any SIEM via the syslog format. I currently do this with a different product however.

Hope that helps.

Re: can we send bro ids log to qradar Ibm?

ALPHADA — Fri, 04 May 2018 21:52:04 GMT

thanks otakar.Kiler for reply ,plz can you tell me or give an ressource to send bro logs to qradar because i didnt find any ressource in the internet

Re: can we send bro ids log to qradar Ibm?

OtakarKlier — Fri, 04 May 2018 21:56:01 GMT

Sure thing, but bro itsself cannt send logs nativly, it uses syslog to do so via a linux system. Here is one example:

https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

Hope that helps.

Re: can we send bro ids log to qradar Ibm?

ALPHADA — Sat, 05 May 2018 01:10:32 GMT

are bro logs sys logs? or we should do an other step to parsing bro logs in syslog ,for the example that you gived i had send bro logs to elastic search with no probleme

Re: can we send bro ids log to qradar Ibm?

OtakarKlier — Mon, 07 May 2018 17:25:39 GMT

Hello,

I would follow the instructions on the link I sent, that should work for you. Then you can verify by looking at the logs in your SIEM to make sure they are getting there.

Regards,