You can integrate a Cisco IDS/IPS security device with IBM® QRadar®.
The Cisco IDS/IPS DSM for IBM QRadar collects Cisco IDS/IPS for events by using the Security Device Event Exchange (SDEE) protocol.
The SDEE specification defines the message format and the protocol that is used to communicate the events that are generated by your Cisco IDS/IPS security device. QRadar supports SDEE connections by polling directly to the IDS/IPS device and not the management software, which controls the device.
After you configure your Cisco IDS/IPS device, you must configure the SDEE protocol in QRadar. When you configure the SDEE protocol, you must define the URL that is used to access the device. An example of a URL that defines the device is https//www.example.com/cgi-bin/sdee-server.
You must use http or https in the URL, which is specific to your Cisco IDS version.
- When you use RDEP (for Cisco IDS 4.0), ensure that the URL has
/cgi-bin/event-serverat the end of the URL. An example URL is https://www.example.com/cgi-bin/event-server.
- When you use SDEE/CIDEE (for Cisco IDS 5.x and later), ensure that the URL has
/cgi-bin/sdee-serverat the end of the URL. An example URL is https://www.example/cgi-bin/sdee-server.