Microsoft

IBM® QRadar® supports a range of Microsoft products.

Microsoft 365 Defender
The IBM QRadar Microsoft 365 Defender® DSM collects events from a Microsoft 365 Defender service by using the Microsoft Azure Event Hubs protocol to collect Streaming API data. You can use the Defender for Endpoint SIEM REST API protocol to collect alerts and device events from a Microsoft 365 Defender service.
Microsoft Entra ID
Microsoft Entra ID is formerly known as Microsoft Azure Active Directory. The DSM RPM name remains as Microsoft Azure Active Directory.
Microsoft Azure Platform
The IBM QRadar DSM for Microsoft Azure Platform parses events from the Microsoft Azure Activity log.
Microsoft Defender for Cloud
The IBM QRadar DSM for Microsoft Defender for Cloud collects JSON events from a Microsoft Defender for Cloud. Events can be collected by using the Microsoft Graph Security API protocol and the Microsoft Azure Event Hubs protocol.
Microsoft DHCP Server
The Microsoft DHCP Server DSM for IBM Security QRadar accepts DHCP events using the Microsoft DHCP Server protocol or WinCollect.
Microsoft DNS Debug
The IBM QRadar DSM for Microsoft DNS Debug collects events from a Microsoft Windows system.
Microsoft Endpoint Protection
The Microsoft Endpoint Protection DSM for IBM QRadar collects malware detection events.
Microsoft Exchange Server
The IBM QRadar DSM for Microsoft Exchange Server collects Exchange events by polling for event log files.
Microsoft Hyper-V
The IBM Security QRadar DSM for Microsoft Hyper-V can collect event logs from your Microsoft Hyper-V servers.
Microsoft IAS Server
The Microsoft IAS Server DSM for IBM Security QRadar accepts RADIUS events using syslog.
Microsoft IIS Server
The Microsoft Internet Information Services (IIS) Server DSM for IBM Security QRadar accepts FTP, HTTP, NNTP, and SMTP events using syslog.
Microsoft ISA
The Microsoft Internet and Acceleration (ISA) DSM for IBM Security QRadar accepts events using syslog.
Microsoft Office 365
The IBM QRadar DSM for Microsoft Office 365 collects events from Microsoft Office 365 online services.
Microsoft Office 365 Message Trace
The IBM QRadar DSM for Microsoft Office 365 Message Trace collects JSON events from a Microsoft Office 365 Message Trace by using the Office 365 Message Trace API protocol.
JDBC log source parameters for Microsoft Operations Manager
If QRadar does not automatically detect the log source, add a Microsoft Operations Manager log source on the QRadar Console by using the JDBC protocol.
Microsoft SharePoint
The Microsoft SharePoint DSM for IBM QRadar collects audit events from the SharePoint database by using JDBC to poll an SQL database for audit events.
Microsoft SQL Server
The IBM QRadar DSM for Microsoft SQL Server collect SQL events by using the syslog, WinCollect Microsoft SQL, or JDBC protocol.
JDBC log source parameters for Microsoft System Center Operations Manager
If QRadar does not automatically detect the log source, add a Microsoft System Center Operations Manager (SCOM) log source on the QRadar Console by using the JDBC protocol.
Microsoft Windows Security Event Log
The IBM QRadar DSM for Microsoft Windows Security Event Log accepts syslog events from Microsoft Windows systems. All events, including Sysmon and winlogbeats.json, are supported.