VMware vCenter

The VMware vCenter DSM for IBM QRadar collects vCenter server events by using the EMC VMWare protocol.

The EMC VMware protocol uses HTTPS to poll for vCenter appliances for events. You must configure a log source in QRadar to collect VMware vCenter events. For more information about configuring EMC VMWare log source parameters, see EMC VMWare log source parameters for VMware vCenter.

Before you configure your log source to use the EMC VMWare protocol, it is suggested that you create a unique user to poll for events. This user can be created as a member of the Linux® root or Windows administrative group, but you must provide the user with an assigned role of read-only permission in vSphere. This ensures that QRadar can collect the maximum number of events and retain a level of security for your virtual servers. For more information about user roles, see your VMware documentation.