Carbon Black Bit9 Parity

To collect events, you must configure your Carbon Black Bit9 Parity device to forward syslog events in Log Event Extended Format (LEEF).

Procedure

  1. Log in to the Carbon Black Bit9 Parity console with Administrator or PowerUser privileges.
  2. From the navigation menu on the left side of the console, select Administration > System Configuration.

    The System Configuration window is displayed.

  3. Click Server Status.

    The Server Status window is displayed.

  4. Click Edit.
  5. In the Syslog address field, type the IP address of your QRadar Console or Event Collector.
  6. From the Syslog format list, select LEEF (Q1Labs).
  7. Select the Syslog enabled check box.
  8. Click Update.

    The configuration is complete. The log source is added to IBM QRadar as Carbon Black Bit9 Parity events are automatically discovered. Events that are forwarded to QRadar by Carbon Black Bit9 Parity are displayed on the Log Activity tab of QRadar.