To collect all events from CyberArk Privileged Threat Analytics, you must specify IBM
QRadar as the syslog server and
configure the syslog format. The CyberArk Privileged Threat Analytics device sends syslog events
that are formatted as Log Event Extended Format (LEEF).
Procedure
-
On the CyberArk Privileged Threat Analytics machine, go to the
/opt/tomcat/diamond-resources/local/ directory, and open the
systemparm.properties file in a text editor such as vi.
-
Uncomment the syslog_outbound property and then edit the following
parameters:
| Parameter |
Value |
|---|
| Host |
The host name or IP address of the QRadar system. |
| Port |
514 |
| Protocol |
UDP |
| Format |
LEEF |
The following is an example of the syslog_outbound
property:
syslog_outbound=[{"host": "SIEM_MACHINE_ADDRESS", "port": "514", "format":
"LEEF", "protocol": "UDP"}]
The following is an example of the syslog_outbound property
specifying multiple syslog recipients, separated by commas:
syslog_outbound=[{"host":
"SIEM_MACHINE_ADDRESS", "port": "514", "format": "LEEF", "protocol": "UDP"} , {"host":
"SIEM_MACHINE_ADDRESS1", "port": "514", "format": "LEEF", "protocol": "UDP"} ,
…]
-
Save the systemparm.properties configuration file, and then close
it.
-
Restart CyberArk Privileged Threat Analytics.