HCL BigFix (formerly known as IBM BigFix)
If IBM QRadar does not automatically detect the log source, add an HCL BigFix log source on the QRadar Console by using the IBM® BigFix SOAP protocol.
When you use the IBM BigFix SOAP protocol, there are specific parameters that you must configure.
The following table describes the parameters that require specific values to collect IBM BigFix SOAP events from HCL BigFix:
|
Parameter |
Value |
|---|---|
| Log Source type | IBM BigFix |
| Protocol Configuration | HCL BigFix SOAP |
| Log Source Identifier |
Type the IP address or host name for your HCL BigFix appliance. The IP address or host name identifies your HCL BigFix as a unique event source in QRadar. |
| Port |
Type the port number that is used to connect to HCL BigFix by using the SOAP API. By default, port 80 is the port number for communicating with HCL BigFix. If you are use HTTPS, you must update this field to the HTTPS port number for your network. Most configurations use port 443 for HTTPS communications. |
| Use HTTPS |
Enable this option to connect by using HTTPS. If you enable this option, the host name or IP address you specify uses HTTPS to connect to your HCL BigFix. If a certificate is required to connect by using HTTPS, you must copy any certificates that are required by the QRadar Console or managed host to the following directory: /opt/qradar/conf/trusted_certificates QRadar support certificates with the following file extensions: .crt, cert, or .der. Copy any required certificates to the trusted certificates directory before you save and deploy your changes. |
| Username |
Type the username that you use to access your HCL BigFix. |
| Password |
Type the password that you use to access your HCL BigFix. |
| Confirm Password |
Confirm the password that is required to access your HCL BigFix. |
For a complete list of IBM BigFix SOAP protocol parameters and their values, see IBM BigFix SOAP protocol configuration options.
For more information about configuring QRadar to import HCL BigFix vulnerabilities assessment information, see the IBM QRadar Vulnerability Assessment Configuration Guide.