IBM Fiberlink REST API protocol configuration options

To receive Log Event Extended Format (LEEF) formatted events from IBM® MaaS360® appliances, configure a log source that uses the IBM Fiberlink® REST API protocol.

The IBM Fiberlink REST API protocol is an outbound (or active) protocol. As events are retrieved, the IBM MaaS360 DSM parses and categorizes events.

The following table describes the protocol-specific parameters for the IBM Fiberlink REST API protocol.

Table 1. IBM Fiberlink REST API protocol log source parameters
Parameter	Value
Log Source Type	IBM Fiberlink MaaS360
Protocol Configuration	IBM Fiberlink REST API
Log Source Identifier	Type a unique identifier for the log source. The Log Source Identifier can be set to any valid value and does not need to reference a specific server. You can set the Log Source Identifier to the same value as the Log Source Name. If you have more than one IBM Fiberlink® MaaS360® log source that is configured, you might want to give them similar but unique names. For example, you can name the first log source `fiberlink1`, the second log source `fiberlink2`, and the third log source `fiberlink3`.
Login URL	Copy the URL for the Fiberlink MaaS360 REST server.
Username	Type the username used to access the MaaS360 APIs. Users with the following administrator roles can access the APIs: Service Administrator Administrator Administrator-Level 2
Password	Type the password used to access your MaaS360 APIs.
Secret Key	The secret key provided by Fiberlink Customer Service when you enable the REST API.
App ID	The app ID provided by Fiberlink Customer Service when you enable the REST API.
Billing ID	The billing ID for your Fiberlink MaaS360 account
Platform	The platform version of the Fiberlink MaaS360 console.
App Version	The app version of the application that corresponds to your REST API account.
Use Proxy	If IBM QRadar accesses the Fiberlink MaaS360 API by using a proxy, enable the Use Proxy option. If the proxy requires authentication, configure the Proxy IP or Hostname, Proxy Port, Proxy Username, and Proxy Password fields. If the proxy does not require authentication, configure the Proxy IP or Hostname and Proxy Port fields. This parameter is disabled by default.
Proxy IP or Hostname	The IP or hostname of the proxy server that you want to use. This parameter is available if the Use Proxy option is enabled.
Proxy Port	The port number used to communicate with the proxy. The default port number is 8080. This parameter is available if the Use Proxy option is enabled.
Proxy Username	The username that you use to access the proxy server. This parameter is available if the Use Proxy option is enabled.
Proxy Password	The password that you use to access the proxy server. This parameter is available if the Use Proxy option is enabled.
Automatically Acquire Server Certificate(s)	If the Yes option is selected, the log source automatically downloads the server certificate and begins trusting the target server.
EPS Throttle	The maximum number of events per second that QRadar ingests. If your data source exceeds the EPS throttle, data collection is delayed. Data is still collected and then it is ingested when the data source stops exceeding the EPS throttle. The default is 5000.
Recurrence	The time interval between log source queries to IBM Fiberlink MaaS360 for new events. The time interval can be in minutes (M), hours (H), or days (D). For example, 1 M, 3 H, 5 D. The default is 60 minutes (60 M).