Supported Honeycomb FIM event types logged by QRadar

The Honeycomb FIM DSM for IBM QRadar can collect events from several event categories.

Each event category contains low-level events that describe the action that is taken within the event category. For example, file rename events might have a low-level category of either file rename successful or file rename failed.

The following list defines the event categories that are collected by QRadar for Honeycomb file integrity events:

• Baseline events
• Open file events
• Create file events
• Rename file events
• Modify file events
• Delete file events
• Move file events
• File attribute change events
• File ownership change events

QRadar can also collect Windows and other log files that are forwarded from Honeycomb Lexicon. However, any event that is not a file integrity event might require special processing by a custom log source type or a log source extension in QRadar.