ARCON-PAM sample event messages
Use these sample event messages as a way of verifying a successful integration with QRadar®.
Important: Due to formatting issues, paste the message format into a text editor and
then remove any carriage return or line feed characters.
The following sample event message shows SIEM Connector Service Configurations collected from ARCON-PAM application
03 Oct 23 17:01:27 : ARCON arcon.pam.test CEF:0|ARCON|PAM-SIEM|1.0|9200|Service Access|1|EventTimeStamp=2023-10-03 13:02:26 LOBProfile=LOBDC UserID=xxx UserName=TEST USERNAME1 UserMAC=00:00:5E:00:53:00 UserSesssionID=xxxx ServerID=xxx ServerIPAddress=10.0.0.2 ServerUserID=pimadmin ServeConnectionType=SSH Router ServerSessionID=xxx ServerSessionLoginTimeStamp=03-10-2023 11:35:42 ServerSessionLogoutTimeStamp=03-10-2023 11:39:49 UserDisplayName=TEST USERNAME1 ID=xxxx| QRadar field name | Highlighted payload field name |
|---|---|
| Event ID | 9200 |
| Event category | Service Access |
| SEVERITY | 1 |
| Destination IP | ServerIPAddress |
| Source MAC | UserMAC |
| USERNAME | UserName |
| Device Time | EventTimeStamp |