Configuring Cisco IronPort appliances to communicate with QRadar

Complete the configuration on Cisco IronPort appliances so that they can send events to QRadar®.

Procedure

  1. To configure your Cisco IronPort Appliance to push Web Content Filter events, you must configure a log subscription for the Web Content Filter that uses the W3C format. For more information, see your Cisco IronPort documentation.
  2. To configure your Cisco Email Security Appliance (ESA) to push message data, anti-virus events, you must configure a log subscription. For more information, see the Cisco ESA documentation: Configuring Log Subscriptions (https://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa10-0/ESA_10-0_User_Guide.pdf).
  3. To configure your Cisco Web Security Appliance (WSA) to push Web Proxy filtering and traffic monitoring activity events, you must configure a log subscription. For more information, see the Cisco WSA documentation: Adding and Editing Log Subscriptions (https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/wsa_10-0/WSA_10-1-0_UserGuide.pdf).
    Note: When you add a log subscription on your Cisco Web Security Appliance (WSA), the Log Style parameter value must be Squid.