To collect IBM® DataPower® events, configure your third-party system to send events to IBM
QRadar®.
Before you begin
Review the DataPower logging documents to
determine which logging configuration changes are appropriate for your deployment. See IBM Knowledge Center
(https://www.ibm.com/docs/en/SS9H2Y_10cd/com.ibm.dp.doc/logtarget_logs.html).
Procedure
-
Log in to your IBM DataPower system.
-
In the search box on the left navigation menu, type Log Target.
-
Select the matching result.
-
Click Add.
-
In the Main tab, type a name for the log target.
-
From the Target Type list, select syslog.
-
In the Local Identifier field, type an identifier to be displayed in
the Syslog event payloads parameter on the QRadar user interface.
-
In the Remote Host field, type the IP address or host name of your QRadar Console or Event
Collector.
-
In the Remote Port field, type 514.
-
Under Event Subscriptions, add a base logging configuration with the
following parameters:
| Parameter |
Value |
|---|
| Event Category |
all |
| Minimum Event Priority |
warning Important: To prevent a decrease in system
performance, do not use more than one word for the Minimum Event Priority
parameter.
|
-
Apply the changes to the log target.
-
Review and save the configuration changes.