Configuring QRadar Event and Flow Exporter
- On the Admin tab, click .
- Paste the token string into the SEC Token field.
- Set the retention policy for how many files to save for each query saved in the app. The default value is 5.
- Click Set configuration.
- Configure your email server to receive notifications when a query completes:
When you receive an email, you can click the embedded links to open the result files and download them if necessary.Important: This process might fail if you can't access IBM QRadar from your current network.
- Enter the email server Host IP and port number.
- Enable or disable TLS according to your email server configuration.
- Enter the email server administrator email ID and password.
- Select an attachment size.
- Click Configure email server.
A success message is displayed when the app is successfully configured.
Tip: If the Event and Flow Exporter tab doesn't appear automatically, go to the main menu and select the star next to the app name to add it.