Microsoft Windows Security Event Log log source parameters

When you add a Microsoft Windows Security Event Log log source on the QRadar® Console by using the Syslog protocol, there are specific parameters you must use.

The following table describes the parameters that require specific values to collect Syslog events from Microsoft Windows Security Event Log:

Table 1. Microsoft Windows Security Event Log Syslog log source parameters for the Microsoft Windows Security Event Log DSM
Parameter	Value
Log Source type	Microsoft Windows Security Event Log
Protocol Configuration	Syslog
Log Source Identifier	The host ID of the logstash server.

For a complete list of Syslog protocol parameters and their values, see Adding a log source.