Configuring HashiCorp Vault to communicate with QRadar

To configure HashiCorp Vault audit logs to send to IBM QRadar®, follow these steps.

Procedure

Enable Vault Audit Logging to Syslog
1. Vault supports multiple audit type events. To enable Syslog auditing, modify the Vault configuration in /etc/vault.d/vault.hcl file.
```
audit { 
  type = "syslog" 
  options = { 
    tag = "vault_audit" 
    facility = "LOCAL0" // One of type of Audit type log 
  } 
} 
```
2. After you change the config file, it is recommended to restart vault by running the following command.
```
systemctl restart vault 
```
3. To confirm if the restart of vault is successfully completed, run the following command.
```
systemctl status vault
```
Configure Syslog to forward events to QRadar SIEM
1. By default, Linux uses rsyslog that is needed to configure forwarding events to QRadar SIEM Event Collector: You can modify the /etc/rsyslog.conf file or create a file in the /etc/rsyslog.d/vault.conf directory:
```
local0.*    @@<QRADAR_IP>:514 
```
  - Use @ for UDP or @@ for TCP forwarding.
  - Replace <QRADAR_IP> with your QRadar SIEM Event Collector IP.
  - Local0.* is the facility name that is defined in the /etc/vault.d/vault.hcl file.
  - By default, the QRadar SIEM Syslog protocol listens to 514 ports only. It is not recommended to modify this port.
Restart rsyslog service by running the following command.
```
systemctl restart rsyslog
```