IBM Security Identity Manager JDBC log source parameters for IBM Security Identity Manager

If QRadar does not automatically detect the log source, add an IBM® Security Identity Manager log source on the QRadar Console by using the IBM Security Identity Manager JDBC protocol.

When using the IBM Security Identity Manager JDBC protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect JDBC events from IBM Security Identity Manager:

Table 1. IBM Security Identity Manager JDBC log source parameters for the IBM Security Identity Manager DSM
Parameter	Value
Log Source type	IBM Security Identity Manager
Protocol Configuration	IBM Security Identity Manager JDBC
Log Source Identifier	Type the IP address or host name for the log source as an identifier for events from your IBM Security Identity Manager devices.
Database Type	From the Database Type list, select a database to use for the event source. The options include the following databases: DB2® - Select this option if DB2 is the database type on your IBM Security Identity Manager appliance. DB2 is the default database type. MSDE - Select this option if MSDE is the database type on your IBM Security Identity Manager appliance. Oracle - Select this option if Oracle is the database type on your IBM Security Identity Manager appliance.
Database Name	The name of the database to which you want to connect.
IP or Hostname	Type the IP address or host name of the IBM Security Identity Manager appliance.
Port	Type the port number that is used by the database server. The default that is displayed depends on the selected Database Type. The valid range is 0 - 65536. The default for DB2 is port 50000. The JDBC configuration port must match the listener port of the database. The database must have incoming TCP connections that are enabled to communicate with QRadar. The default port number for all options include: DB2 - 50000 MSDE - 1433 Oracle - 1521 If you define a database Instance when you use MSDE as the database type, you must leave the Port parameter blank in your configuration.
Username	Type the database user name. The user name can be up to 255 alphanumeric characters in length. The user name can also include underscores (_).
Password	Type the database password. The password can be up to 255 characters in length.
Schema Name	Type `ISIMUSER` in the Schema Name field.
Table Name	Type `AUDIT_EVENT` as the name of the table or view that includes the event records. If you change the value of this field from the default, events cannot be properly collected by the IBM Security Identity Manager JDBC protocol. The table name can be up to 255 alphanumeric characters in length. The table name can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).
Select List	Type `*` to include all fields from the table or view. You can use a comma-separated list to define specific fields from tables or views, if needed for your configuration. The list must contain the field that is defined in the Compare Field parameter. The comma-separated list can be up to 255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (`#`), underscore (`_`), en dash (`-`), and period(`.`).
Compare Field	Type `TIMESTAMP` to identify new events added between queries to the table by their time stamp. The compare field can be up to 255 alphanumeric characters in length. The list can include the special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).
Start Date and Time (Optional)	Configure the start date and time for database polling. The Start Date and Time parameter must be formatted as yyyy-MM-dd HH: mm with HH specified by using a 24-hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.
Polling Interval	Type the polling interval in seconds, which is the amount of time between queries to the database table. The default polling interval is 30 seconds. You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values without an H or M designator poll in seconds.
EPS Throttle	The maximum number of events per second that QRadar ingests. If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle. The default is 5000.
Authentication Domain	If you select MSDE as the Database Type, the Authentication Domain field is displayed. If your network is configured to validate users with domain credentials, you must define a Windows Authentication Domain. Otherwise, leave this field blank. The authentication domain must contain alphanumeric characters. The domain can include the following special characters: underscore (_), en dash (-), and period(.).
Database Instance	If you select MSDE as the Database Type, the Database Instance field is displayed. Type the instance to which you want to connect, if you have multiple SQL server instances on one server. If you use a non-standard port in your database configuration, or access to port 1434 for SQL database resolution is blocked, you must leave the Database Instance parameter blank in your configuration.
Use Named Pipe Communication	If you select MSDE as the Database Type, the Use Named Pipe Communication check box is displayed. By default, this check box is clear. Select this check box to use an alternative method to a TCP/IP port connection. When you use Named Pipe connection, the user name and password must be the appropriate Windows authentication user name and password and not the database user name and password. Also, you must use the default Named Pipe.
Use NTLMv2	If you select MSDE as the Database Type, the Use NTLMv2 check box is displayed. Select the Use NTLMv2 check box to force MSDE connections to use the NTLMv2 protocol when they communicate with SQL servers that require NTLMv2 authentication. The default value of the check box is selected. If the Use NTLMv2 check box is selected, it has no effect on MSDE connections to SQL servers that do not require NTLMv2 authentication.
Database Cluster Name	If you select the Use Named Pipe Communication check box, the Database Cluster Name parameter is displayed. If you are running your SQL server in a cluster environment, define the cluster name to ensure Named Pipe communication functions properly.