Top Layer IPS

The Top Layer IPS DSM for IBM QRadar accepts Top Layer IPS events by using syslog.

QRadar records and processes Top Layer events. Before you configure QRadar to integrate with a Top Layer device, you must configure syslog within your Top Layer IPS device. For more information on configuring Top Layer, see your Top Layer documentation.

The configuration is complete. The log source is added to QRadar as Top Layer IPS events are automatically discovered. Events that are forwarded to QRadar by Top Layer IPS are displayed on the Log Activity tab of QRadar.

To configure QRadar to receive events from a Top Layer IPS device:

From the Log Source Type list, select the Top Layer Intrusion Prevention System (IPS) option.

For more information about your Top Layer device, see your vendor documentation.