Configuring your Resolution1 CyberSecurity device to communicate with QRadar

To collect Resolution1 CyberSecurity events, you must configure your third-party device to generate event logs in LEEF format. You must also create an FTP site for Resolution1 CyberSecurity to transfer the LEEF files. QRadar can then pull the logs from the FTP server.

Procedure

  1. Log in to your Resolution1 CyberSecurity device.
  2. Open the ADGIntegrationServiceHost.exe.config file, which is in the C:\Program Files\AccessData\eDiscovery\Integration Services directory.
  3. Change the text in the file to match the following lines: 
    <Option Name="Version" Value="2.0" /> 
<Option Name="Version" Value="2.0" /> 
<Option Name="OutputFormat" Value="LEEF" /> 
<Option Name="LogOnly" Value="1" />  
<Option Name="OutputPath" Value="C:\CIRT\logs" />
  4. Restart the Resolution1 Third-Party Integration service.
  5. Create an FTP site for the C:\CIRT\logs output folder:
    1. Open Internet Information Services Manager (IIS).
    2. Right-click the Sites tab and click Add FTP Site.
    3. Name the FTP site, and enter C:\CIRT\logs as the location for the generated LEEF files.
    4. Restart the web service.