Syslog log source parameters for OSSEC

If QRadar does not automatically detect the log source, add an OSSEC log source on the QRadar Console by using the Syslog protocol.

When you use the Syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Syslog events from OSSEC:

Table 1. Syslog parameters log source parameters for the OSSEC DSM
Parameter	Description
Log Source type	OSSEC
Protocol Configuration	Syslog
Log Source Identifier	Type the IP address or hostname for the log source as an identifier for events from your OSSEC installation.