JDBC log source parameters for Sybase ASE

If QRadar does not automatically detect the log source, add a Sybase ASE log source on the QRadar Console by using the JDBC protocol.

When using the JDBC protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect JDBC events from Sybase ASE:

Table 1. JDBC log source parameters for the Sybase ASE DSM
Parameter	Value
Log Source Name	Type a unique name for the log source.
Log Source Description	Type a description for the log source.
Log Source Type	Sybase ASE
Protocol Configuration	JDBC
Log Source Identifier	Type a name for the log source. The name can't contain spaces and must be unique among all log sources of the log source type that is configured to use the JDBC protocol. If the log source collects events from a single appliance that has a static IP address or host name, use the IP address or host name of the appliance as all or part of the Log Source Identifier value; for example, 192.168.1.1 or JDBC192.168.1.1. If the log source doesn't collect events from a single appliance that has a static IP address or host name, you can use any unique name for the Log Source Identifier value; for example, JDBC1, JDBC2.
Database Type	Sybase
Database Name	The name of the database to which you want to connect.
IP or Hostname	The IP address or host name of the database server.
Port	Enter the JDBC port. The JDBC port must match the listener port that is configured on the remote database. The database must permit incoming TCP connections. The valid range is 1 - 65535. The defaults are: MSDE - 1433 Postgres - 5432 MySQL - 3306 Sybase - 1521 Oracle - 1521 Informix® - 9088 DB2® - 50000 If a database instance is used with the MSDE database type, you must leave the Port field blank.
Username	A user account for QRadar in the database.
Password	The password that is required to connect to the database.
Confirm Password	The password that is required to connect to the database.
Predefined Query	Select a predefined database query for the log source. If a predefined query is not available for the log source type, administrators can select the none option.
Table Name	The name of the table or view that includes the event records. The table name can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period (.).
Select List	The list of fields to include when the table is polled for events. You can use a comma-separated list or type an asterisk (*) to select all fields from the table or view. If a comma-separated list is defined, the list must contain the field that is defined in the Compare Field.
Compare Field	A numeric value or time stamp field from the table or view that identifies new events that are added to the table between queries. Enables the protocol to identify events that were previously polled by the protocol to ensure that duplicate events are not created.
Use Prepared Statements	Prepared statements enable the JDBC protocol source to set up the SQL statement, and then run the SQL statement numerous times with different parameters. For security and performance reasons, most JDBC protocol configurations can use prepared statements.
Start Date and Time	Type the start date and time for database polling in the following format: yyyy-MM-dd HH:mm with HH specified by using a 24-hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.
Polling Interval	Enter the amount of time between queries to the event table. To define a longer polling interval, append H for hours or M for minutes to the numeric value The maximum polling interval is one week.
EPS Throttle	The maximum number of events per second that QRadar ingests. If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle. The valid range is 100 to 20,000.
Enabled	Select this check box to enable the log source. By default, the check box is selected.
Credibility	From the list, select the Credibility of the log source. The range is 0 - 10. The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source devices. Credibility increases if multiple sources report the same event. The default is 5.
Target Event Collector	Select the Target Event Collector to use as the target for the log source.
Coalescing Events	Select the Coalescing Events check box to enable the log source to coalesce (bundle) events. By default, automatically discovered log sources inherit the value of the Coalescing Events list from the System Settings in QRadar. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.
Store Event Payload	Select the Store Event Payload check box to enable the log source to store event payload information. By default, automatically discovered log sources inherit the value of the Store Event Payload list from the System Settings in QRadar. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.