can we send bro ids log to qradar Ibm?

[ALPHADA]

hello every body , i have a project when i shall send the bro ids log to qradar Siem ,i want to know if it is possible or not

[OtakarKlier]

Hello,

So both bro and PAN can sernd logs to any SIEM via the syslog format. I currently do this with a different product however.

Hope that helps.

[ALPHADA]

thanks otakar.Kiler for reply ,plz can you tell me or give an ressource to send bro logs to qradar because i didnt find any ressource in the internet 

[OtakarKlier]

Sure thing, but bro itsself cannt send logs nativly, it uses syslog to do so via a linux system. Here is one example:

https://github.com/Security-Onion-Solutions/security-onion/wiki/Bro

Hope that helps.

[ALPHADA]

are bro logs sys logs? or we should do an other step to parsing bro logs in syslog ,for the example that you gived i had send bro logs to elastic search with no probleme 

[OtakarKlier]

Hello,

I would follow the instructions on the link I sent, that should work for you. Then you can verify by looking at the logs in your SIEM to make sure they are getting there.

Regards,