Syslog log source parameters for BeyondTrust PowerBroker

If QRadar® does not automatically detect the log source, add a BeyondTrust PowerBroker log source on the QRadar Console by using the Syslog protocol.

When using the Syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Syslog events from BeyondTrust PowerBroker:
Table 1. Syslog log source parameters for the BeyondTrust PowerBroker DSM
Parameter Value
Log Source type BeyondTrust PowerBroker
Protocol Configuration Syslog
Log Source Identifier Type a unique IP address or host name.
Store Event Payload

Select this check box to enable or disable QRadar from storing the event payload.

Automatically discovered log sources use the default value from the Store Event Payload list in the System Settings window, which is accessible on the Admin tab. However, when you create a new log source or update the configuration for an automatically discovered log source, you can override the default value by configuring this check box for each log source.