Configuring a Cisco IronPort and Cisco WSA log source by using the Syslog protocol
You can configure a log source on the QRadar® Console so that the Cisco IronPort Appliance and Cisco Web Security Appliance (WSA) can communicate with QRadar by using the Syslog protocol.
|Log Source type||Cisco IronPort|
|Log Source Identifier||The IPv4 address or host name that identifies the log source.
If your network contains multiple devices that are attached to a single management console, specify the IP address of the individual device that created the event. A unique identifier, such as an IP address, prevents event searches from identifying the management console as the source for all of the events.