Log source groups

You can categorize your log sources into groups to efficiently view and track your log sources. For example, you might group your log sources by functional purpose, physical location, or business unit association.

You can also use log source groups in searches and rules, instead of listing the log sources to which the search or rule applies.

You must have administrative access to create, edit, or delete groups. For more information about user roles, see the IBM QRadar Administration Guide.