QRadar supported DSMs

IBM® QRadar® can collect events from your security products by using a plug-in file that is called a Device Support Module (DSM).

QRadar can receive logs from systems and devices by using the Syslog protocol, which is a standard protocol. Supported DSMs can use other protocols, as mentioned in the Supported DSM table. You can try to configure third-party applications to send logs to QRadar through the Syslog protocol. For more information, see Adding a log source.

If you want to send logs by using a supported DSM that is not supported by the auto discovery feature in QRadar, you need to manually add a log source. For more information about adding a log source in QRadar, see Adding a log source.

Important: When you upgrade your IBM QRadar system, custom DSMs are not removed during the upgrade.

What do you do if the product version or device you have is not listed in the DSM Configuration Guide?

Sometimes a version of a vendor product or a device is not listed as supported. If the product or device is not listed, follow these guidelines:

Version not listed

If the DSM for your product is officially supported by QRadar, but your product version is not listed in the IBM QRadar DSM Configuration Guide, you have the following options:

Try the DSM to see whether it works. The product versions that are listed in the guide are tested by IBM, but newer untested versions can also work.
If you tried the DSM and it didn’t work, open a support ticket for a review of the log source to troubleshoot and rule out any potential issues.
Tip: In most cases, no changes are necessary, or perhaps a minor update to the IBM QRadar Identifier (QID) Map might be all that is required. Software updates by vendors might on rare occasions add or change event formats that break the DSM, requiring an RFE for the development of a new integration. This is the only scenario where an RFE is required.

Device not listed

When a device is not officially supported, you have the following options:

Open a request for enhancement (RFE) to have your device become officially supported.
- Go to the QRadar SIEM RFE page (https://ibm.biz/BdRPx5).
- Log in to the support portal page.
- Click the Submit tab and type the necessary information.
  
  Tip: If you have event logs from a device, attach the event information and include the product version of the device that generated the event log.

Write a log source extension to parse events for your device. For more information, see Log source extensions and the DSM Editor.
You can use content extensions for sending events to QRadar that are provided by some third-party vendors. They can be found on the IBM Security App Exchange (https://exchange.xforce.ibmcloud.com/hub/). These third-party DSM integrations are supported by the vendor, not by IBM. For a list of available third-party DSMs, see DSMs supported by third-party vendors.

The following table lists supported DSMs for third-party and IBM QRadar solutions.

Tip: To view all seven columns in the table, you might need to scroll to the right.

Table 1. QRadar Supported DSMs
Manufacturer	Device name and version	Protocol	Recorded events and formats	Auto discovered?	Includes identity?	Includes custom properties?
3Com	8800 Series Switch V3.01.30	Syslog	Status and network condition events	Yes	No	No
AhnLab	AhnLab Policy Center	AhnLabPolicy CenterJdbc	Spyware detection Virus detection Audit	No	Yes	No
Akamai	Akamai KONA	HTTP Receiver Akamai Kona REST API	Event format: JSON Recorded event types: All security events	No	No	No
Alibaba Cloud	Alibaba ActionTrail	Alibaba Cloud Object Storage Syslog	Event format: JSON	Yes	Yes	No
Amazon	Amazon AWS Application Load Balancer Access Logs	Amazon AWS S3 REST API	Event format: Space delimited pre-defined fields Recorded event types: Access logs	Yes	No	No
Amazon	Amazon AWS CloudTrail	Amazon AWS S3 REST API Amazon Web Services	Event versions 1.0, 1.02, 1.03, 1.04, 1.05, 1.06 and 1.08 events.	Yes	No	No
Amazon	Amazon AWS Config	Amazon AWS S3 REST API	Event format: JSON	Yes	No	No
Amazon	Amazon AWS Elastic Kubernetes Service Supported version: Kubernetes API 1.19	Amazon Web Services	Event format: JSON Recorded event types: Amazon AWS Kubernetes	Yes	No	No
Amazon	Amazon AWS Network Firewall	Amazon AWS S3 REST API	Event format: JSON Recorded event types: Firewall Alert logs, Firewall Flow logs	No	No	No
Amazon	Amazon AWS Route 53	Amazon Web Services (Resolver and Public DNS query logs) Amazon AWS S3 REST API (Resolver query logs only) Syslog	Event format: JSON (Resolver query logs) Space delimited pre-defined fields (Public DNS query logs) Recorded event types: Event versions 1.0	Yes	No	No
Amazon	Amazon AWS Security Hub	Amazon Web Services	Event format: JSON Recorded event types: AWS Security Finding Format (ASFF)	No	No	No
Amazon	Amazon AWS WAFCentrif	Amazon AWS S3 REST API	Event format: JSON Recorded event types: Traffic allow, Traffic block	No	No	No
Amazon	Amazon CloudFront	Amazon Web Services	Event format: Tab Separated Value (TSV) Recorded event types: RealTime Log - TSV	Yes	No	No
Amazon	Amazon GuardDuty	Amazon Web Services	Amazon GuardDuty Findings JSON	No	No	No
Amazon	AWS Verified Access	Amazon AWS S3 REST API, Syslog	Event format: JSON	Yes	Yes	Yes
Ambiron	TrustWave ipAngel V4.0	Syslog	Snort-based events	No	No	No
Apache	HTTP Server V1.3+	Syslog, Syslog-ng	HTTP status	Yes	No	No
APC	UPS	Syslog	Smart-UPS series events	No	No	No
Apple	Apple Mac OS X version 10.12	Syslog	Firewall, web server access, web server error, privilege, and informational events	No	Yes	No
Application Security, Inc.	DbProtect V6.2, V6.3, V6.3sp1, V6.3.1, and v6.4	Syslog	All events	Yes	No	No
Arbor Networks	Arbor Networks Pravail APS V3.1+	Syslog, TLS Syslog	All events	Yes	No	No
Arbor Networks	Arbor Networks Peakflow SP V5.8 to V8.1.2	Syslog, TLS Syslog	Denial of Service (DoS) Authentication Exploit Suspicious activity System	Yes	No	No
Arpeggio Software	SIFT-IT V3.1+	Syslog	All events configured in the SIFT-IT rule set	Yes	No	No
Array Networks	SSL VPN ArraySP v7.3	Syslog	All events	No	Yes	Yes
Aruba Networks	Aruba ClearPass Policy Manager v6.5.0.71095 to v6.11.1	Syslog	Event format: LEEF Event types: session, audit, system, insight	Yes	Yes	No
Aruba Networks	Mobility Controllers v2.5 +	Syslog	All events	Yes	No	No
Avaya Inc.	Avaya VPN Gateway v9.0.7.2	Syslog	All events	Yes	Yes	No
BalaBit IT Security	MicrosoftWindows Security Event Log V4.x	Syslog	Microsoft Event Log events	Yes	Yes	No
BalaBit IT Security	Microsoft ISA V\v4.x	Syslog and WinCollect	Microsoft Event Log vents	Yes	Yes	No
Barracuda Networks	Spam & Virus Firewall v5.x and later	Syslog	All events	Yes	No	No
Barracuda Networks	Web Application Firewall v7.0.x	Syslog	System, web firewall, access, and audit events	Yes	No	No
Barracuda Networks	Web Filter v6.0.x+	Syslog	Web traffic and web interface events	Yes	No	No
BlueCat Networks	Adonis v6.7.1-P2+	Syslog	DNS and DHCP events	Yes	No	No
Blue Coat	SG v4.x+	Syslog, Log File Protocol	All events	No	No	Yes
Blue Coat	Web Security Service		Blue Coat ELFF, Access	No	No	No
Box	Box	Box REST API	Event format: JSON RTC 256758 Event types: Administrator and enterprise events, Box Shield Alerts	No	Yes	No
Bridgewater Systems	AAA v8.2c1	Syslog	All events	Yes	Yes	No
Broadcom	CA Access Control Facility (ACF2) (Formerly known as CA Technologies ACF2)	Log File Protocol	All events	No	No	Yes
Broadcom	CA Top Secret (Formerly known as CA Technologies Top Secret)	Log File Protocol	All events	No	No	Yes
Broadcom	Symantec SiteMinder (Formerly known as CA SiteMinder)	Syslog, Log File	All events	No	Yes	No
Brocade	Fabric OS v7.x	Syslog	System and audit events	Yes	No	No
Carbon Black	Carbon Black v5.1 and later	Syslog	Watchlist hits	Yes	No	No
Carbon Black	Carbon Black Bit9 Parity	Syslog	LEEF	Yes		No
Carbon Black	Carbon Black Bit9 Security Platform v6.0.2	Syslog	All events	Yes	Yes	No
Centrify	Centrify Identity Platform Now known as CyberArk Identity
Centrify	Centrify Infrastructure Services 2017	Syslog and WinCollect	WinCollect logs, Audit events	Yes	No	No
Check Point	Check Point versions NG, FP1, FP2, FP3, AI R54, AI R55, R65, R70, R75, R77, R80, R81, and NGX	Syslog or OPSEC LEA	Event format: LEEF (versions R77.30, R80.10, R80.20, R81.10) Event types: All events	Yes	Yes	Yes
Check Point	VPN-1 versions NG, FP1, FP2, FP3, AI R54, AI R55, R65, R70, R77, R80, R81, and NGX	Syslog or OPSEC LEA	Event format: LEEF (versions R77.30, R80.10, R80.20, R81.10) Event types: All events	Yes	Yes	No
Check Point	Check Point Multi-Domain Management (Provider-1) versions NG, FP1, FP2, FP3, AI R54, AI R55, R65, R70, R77, R80, R81, and NGX	Syslog or OPSEC LEA	Event format: LEEF (versions R77.30, R80.10, R80.20, R81.10) Event types: All events	Yes	Yes	No
Cilasoft	Cilasoft QJRN/400® v5.14.K+	Syslog	IBM audit events	Yes	Yes	No
Cisco	4400 Series Wireless LAN Controller V7.2	Syslog SNMPv2	All events	No	No	No
Cisco	Cisco CallManager 8.x, 11.5	Syslog	Application events	Yes	No	No
Cisco	ACS V4.1 and later if directly from ACS V3.x and later if using ALE	Syslog	Failed Access Attempts	Yes	Yes	No
Cisco	Aironet V4.x+	Syslog	Cisco Emblem Format	Yes	No	No
Cisco	ACE Firewall V12.2	Syslog	All events	Yes	Yes	No
Cisco	Cisco AMP	Cisco AMP	All security events For a detailed list of supported events, go to the Cisco AMP for Endpoints API documentation. (https://api-docs.amp.cisco.com/api_actions/details?api_action=GET+%2Fv1%2Fevent_types&api_host=api.amp.cisco.com&api_resource=Event+Type&api_version=v1) Note: Network traffic is supported only for Data Flow Control (DCF) events.	No	No	No
Cisco	ASA V7.x and later	Syslog	All events	Yes	Yes	No
Cisco	ASA V7.x+	NSEL Protocol	All events	No	No	No
Cisco	CSA V4.x, V5.x and V6.x	Syslog SNMPv1 SNMPv2	All events	Yes	Yes	No
Cisco	CatOS for catalyst systems V7.3+	Syslog	All events	Yes	Yes	No
Cisco	Cloud Web Security (CWS)	Amazon AWS S3 REST API	W3C All web usage logs	No	No	No
Cisco	Cisco Stealthwatch V6.8	Syslog	Event format: LEEF Event types: Anomaly, Data Hoarding, Exploitation, High Concern, Index, High DDoS Source Index, High Target Index, Policy Violation, Recon, High DDoS Target Index, Data Exfilration, C&C	Yes	No	No
Cisco	IPS V7.1.10 and later, V7.2.x, V7.3.x	SDEE	All events	No	No	No
Cisco	Cisco IronPort V5.5, V6.5, V7.1, V7.5 (adds support for access logs) Cisco IronPort ESA: V10.0 Cisco IronPort WSA: V10.0	Syslog, Log File protocol	Event format: All events Recorded event types: Mail (syslog) System (syslog) Access (syslog) Web content filtering (Log File) Important: Critical, Warning and Information logs are supported.	No	No	No
Cisco	Cisco Duo	Cisco Duo	Event format: JSON Event types: Authentication logs	Yes	Yes	No
Cisco	Cisco Firepower Management Center V5.2 to V6.4 (formerly known as Cisco FireSIGHT Management Center)	Cisco Firepower eStreamer protocol	Discovery events Correlation and White List events Impact Flag alerts User activity Malware events File events Connection events Intrusion events Intrusion Event Packet Data Intrusion Event Extra Data	No	No	No
Cisco	Cisco Firepower Threat Defense	Syslog	Event format: Syslog, Comma-separated values (CSV), Name-value pair (NVP) Recorded event types: Intrusion, Connection	Yes	Yes	No
Cisco	Cisco Firewall Service Module (FWSM) v2.1+	Syslog	All events	Yes	Yes	Yes
Cisco	Cisco Catalyst Switch IOS, 12.2, 12.5+	Syslog	All events	Yes	Yes	No
Cisco	Cisco Meraki	Syslog	Event format: Syslog Event types: Events Flows security_event_ids_alerted	Yes	No	No
Cisco	Cisco NAC Appliance v4.x +	Syslog	Audit, error, failure, quarantine, and infected events	No	No	No
Cisco	Cisco Nexus v6.x	Syslog	Nexus-OS events	Yes	No	No
Cisco	Cisco PIX Firewall v5.x, v6.3+	Syslog	Cisco PIX events	Yes	Yes	Yes
Cisco	Cisco Identity Services Engine V1.1 to V2.2	UDP Multiline Syslog	Event format: Syslog Event types: Device events	No	Yes	No
Cisco	Cisco IOS 12.2, 12.5+	Syslog	All events	Yes	Yes	No
Cisco	Cisco Secure Workload	Syslog	Event format: JSON	Yes	No	No
Cisco	Cisco Umbrella	Amazon AWS S3 REST API	Event format: Cisco Umbrella CSV Event types: DNS, Proxy, IP	No	No	No
Cisco	Cisco VPN 3000 Concentrator versions VPN 3005, 4.1.7.H	Syslog	All events	Yes	Yes	Yes
Cisco	Cisco Wireless Services Modules (WiSM) V 5.1+	Syslog	All events	Yes	No	No
Citrix	Citrix NetScaler V9.3 to V10.0	Syslog	All events	Yes	Yes	No
Citrix	Citrix Access Gateway V4.5	Syslog	Access, audit, and diagnostic events	Yes	No	No
Cloudera	Cloudera Navigator	Syslog	Audit events for HDFS, HBase, Hive, Hue, Cloudera Impala, Sentry	Yes	No	No
Cloudflare	Cloudflare Logs	Amazon AWS S3 REST API HTTP Receiver	Event format: JSON Event types: HTTP events, Firewall events	Yes	No	No
CloudPassage	CloudPassage Halo	Syslog, Log file	All events	Yes	No	No
CrowdStrike	CrowdStrike Falcon	Syslog LEEF	Incident, Incident summary, Detection summary, Authentication, Detection status update, Uploaded IoCs, Network containment, IP whitelisting, Policy management, CrowdStrike store, Falcon firewall management, Real time response, Event streams	Yes	No	No
CrowdStrike	Falcon Data Replicator	Amazon AWS S3 REST API	Event format: JSON	Yes	No	No
CorreLog	CorreLog Agent for IBM z/OS®	Syslog LEEF	All events	Yes	No	No
CRYPTOCard	CRYPTO- Shield V6.3	Syslog	All events	No	No	No
CyberArk	CyberArk Identity Important: The Centrify Identity Platform DSM name is now the CyberArk Identity DSM. The DSM RPM name remains as Centrify Identity Platform in QRadar.	Centrify Redrock REST API	Event format: JSON Event types: SaaS, Core, Internal and Mobile	No	No	No
CyberArk	CyberArk Privileged Threat Analytics V3.1	Syslog	Detected security events	Yes	No	No
CyberArk	CyberArk Vault V6.x	Syslog	All events	Yes	Yes	No
CyberGuard	Firewall/VPN KS1000 V5.1	Syslog	CyberGuard events	Yes	No	No
Damballa	Failsafe V5.0.2+	Syslog	All events	Yes	No	No
Digital China Networks	DCS and DCRS Series switches V1.8.7	Syslog	DCS and DCRS IPv4 events	No	No	No
DG Technology	DG Technology MEAS	Syslog LEEF	Mainframe events	Yes	No	No
ESET	ESET Remote Administrator V6.4.270	Syslog LEEF	Threat events Firewall Aggregated Event HIPS Aggregated Event Audit events	Yes	Yes	No
Extreme	Dragon V5.0, V6.x, V7.1, V7.2, V7.3, and V7.4	Syslog SNMPv1 SNMPv3	All relevant Extreme Dragon events	Yes	No	No
Extreme	800-Series Switch	Syslog	All events	Yes	No	No
Extreme	Matrix Router V3.5	Syslog SNMPv1 SNMPv2 SNMPv3	SNMP and syslog login, logout, and login failed events	Yes	No	No
Extreme	NetSight Automatic Security Manager V3.1.2	Syslog	All events	Yes	No	No
Extreme	Matrix N/K/S Series Switch V6.x, V7.x	Syslog	All relevant Matrix K-Series, N-Series and S-Series device events	Yes	No	No
Extreme	Stackable and Standalone Switches	Syslog	All events	Yes	Yes	No
Extreme	XSR Security Router V7.6.14.0002	Syslog	All events	Yes	No	No
Extreme	HiGuard Wireless IPS 2R2.0.30	Syslog	All events	Yes	No	No
Extreme	HiPath Wireless Controller 2R2.0.30	Syslog	All events	Yes	No	No
Extreme	NAC 3.2 and 3.3	Syslog	All events	Yes	No	No
Enterprise-IT-Security.com	SF-Sherlock 8.1 and later	LEEF	All_Checks, DB2_Security_Configuration, JES_Configuration, Job_Entry_System_Attack, Network_Parameter, Network_Security, No_Policy, Resource_Access_Viol, Resource_Allocation, Resource_Protection, Running_System_Change, Running_System_Security, Running_System_Status, Security_Dbase_Scan, Security_Dbase_Specialty, Security_Dbase_Status, Security_Parm_Change, Security_System_Attack, Security_System_Software, Security_System_Status, SF-Sherlock, Sherlock_Diverse, Sherlock_Diverse, Sherlock_Information, Sherlock_Specialties, Storage_Management, Subsystem_Scan, Sysplex_Security, Sysplex_Status, System_Catalog, System_File_Change, System_File_Security, System_File_Specialty, System_Log_Monitoring, System_Module_Security, System_Process_Security, System_Residence, System_Tampering, System_Volumes, TSO_Status, UNIX_OMVS_Security, UNIX_OMVS_System, User_Defined_Monitoring, xx_Resource_Prot_Templ	Yes	No	No
Epic	Epic SIEM, Versions Epic 2014, Epic 2015, and Epic 2017	LEEF	Audit, Authentication	Yes	Yes	No
Exabeam	Exabeam 1.7 and 2.0	not applicable	Critical, Anomalous	Yes	No	No
Extreme Networks	Extreme Ware 7.7 and XOS 12.4.1.x	Syslog	All events	No	Yes	No
F5 Networks	F5 Networks BIG-IP AFM 11.3 and 12.x to 14.x	Syslog	Network, network DoS, protocol security, DNS, and DNS DoS events	Yes	Yes	No
F5 Networks	F5 Networks BIG-IP LTM 9.42 to 14.x	Syslog, CSV	All events	No	Yes	No
F5 Networks	F5 Networks BIG-IP ASM 10.1 to 16.x	Syslog	Event formats: CEF (CEF:0 is supported), JSON Recorded event types: All security events	Yes	Yes	No
F5 Networks	F5 Networks BIG-IP APM 10.x to 14.x	Syslog	All events	Yes	No	No
F5 Networks	FirePass 7.0	Syslog	All events	Yes	Yes	No
Fair Warning	Fair Warning 2.9.2	Log File Protocol	All events	No	No	No
Fasoo	Fasoo Enterprise DRM 5.0	JDBC	NVP event format Usage events	No	No	No
Fidelis Security Systems	Fidelis XPS 7.3.x	Syslog	Alert events	Yes	No	No
FireEye	FireEye CMS, MPS, EX, AX, NX, FX, and HX	Syslog, TLS Syslog	Event formats: CEF (CEF:0 is supported), LEEF Recorded event types: All relevant events	Yes	No	No
FreeRADIUS	FreeRADIUS 2.x	Syslog	All events	Yes	Yes	No
Forcepoint	Forcepoint Sidewinder 6.1 (formerly known as McAfee Firewall Enterprise 6.1)	Syslog	Forcepoint Sidewinder audit events	Yes	No	No
Forcepoint	Stonesoft Management Center 5.4 to 6.1	Syslog	Event format: LEEF Event types: Management Center, IPS, Firewall, and VPN events	Yes	No	No
Forcepoint	Forcepoint TRITON 7.7, and 8.2 (formerly known as Websense)	Syslog LEEF	Events for web content from several Forcepoint TRITON solutions, including Web Security, Web Security Gateway, Web Security Gateway Anywhere, and V-Series appliances. All events	Yes	No	No
Forcepoint	Forcepoint V-Series Data Security Suite (DSS) 7.1x (formerly known as Websense)	Syslog	All events	Yes	Yes	Yes
Forcepoint	Forcepoint V-Series Content Gateway V7.1x (formerley known as Websense)	Log File Protocol	All events	No	No	No
ForeScout	CounterACT 7.x and later	Syslog	Denial of Service, system, exploit, authentication, and suspicious events	No	No	No
Fortinet	Fortinet FortiGate Security Gateway FortiOS 6.4 and earlier	Syslog Syslog Redirect	All events	Yes	Yes	Yes
Foundry	FastIron 3.x.x and 4.x.x	Syslog	All events	Yes	Yes	No
genua	genugate 8.2+	Syslog	General error messages High availability General relay messages Relay-specific messages genua programs/daemons EPSI Accounting Daemon - gg/src/acctd Configfw FWConfig ROFWConfig User-Interface Webserver	Yes	Yes	No
Google	Google Cloud Audit Logs	Google Cloud Pub/Sub	Supported services: Google Compute Engine Identity Access Management Identity Platform Cloud Storage Event format: JSON Event types: Storage, list, update	Yes	No	No
Google	Google Cloud Platform Firewall	Google Cloud Pub/Sub	Event format: JSON Event types: Firewall Allow, Firewall Deny	No	No	No
Google	Google G Suite Activity Reports	Google G Suite Activity Reports REST API	Event format: JSON Recorded event types: Admin, drive, login, user accounts	No	No	No
Great Bay	Beacon	Syslog	All events	Yes	Yes	No
H3C Technologies	H3C Comware Platform, H3C Switches, H3C Routers, H3C Wireless LAN Devices, and H3C IP Security Devices version 7 is supported	Syslog	NVP System	No	No	No
HBGary	Active Defense 1.2 and later	Syslog	All events	Yes	No	No
Hewlett Packard Enterprise	HPE Network Automation 10.11	Syslog LEEF	All operational and configuration network events.	Yes	Yes	No
Hewlett Packard Enterprise	HPE ProCurve K.14.52	Syslog	All events	Yes	No	No
Hewlett Packard Enterprise	HPE Tandem	Log File Protocol	Safe Guard Audit file events	No	No	No
Hewlett Packard Enterprise	HPE UX V11.x and later	Syslog	All events	No	Yes	No
Honeycomb Technologies	Lexicon File Integrity Monitor mesh service V3.1 and later	Syslog	integrity events	Yes	No	No
Huawei	S Series Switch S5700, S7700, and S9700 using V200R001C00	Syslog	IPv4 events from S5700, S7700, and S9700 Switches	No	No	No
Huawei	AR Series Router (AR150, AR200, AR1200, AR2200, and AR3200 routers using V200R002C00)	Syslog	IPv4 events	No	No	No
IBM	IBM AIX® V6.1 and V7.1	Syslog, Log File protocol	Configured audit events	Yes	No	No
IBM	IBM AIX 5.x, 6.x, and v7.x	Syslog	Authentication and operating system events	Yes	Yes	No
IBM	IBM BigFixV8.2.x to 9.5.2 (formerly known as Tivoli EndPoint Manager)	IBM BigFix® SOAP Protocol	Server events	No	Yes	No
IBM	IBM BigFix Detect Note: The IBM BigFix Detect DSM for QRadar is deprecated.
IBM	IBM Bluemix® Platform (now known as IBM Cloud® Platform)
IBM	IBM Cloud Activity Tracker	Apache Kafka protocol	Event format: JSON	Yes	No	No
IBM	IBM Cloud Identity (now known as IBM Security Verify
IBM	IBM Cloud Platform (formerly known as IBM Bluemix Platform)	Syslog, TLS Syslog	All System (Cloud Foundry) events, some application events	Yes	No	No
IBM	IBM DLC Metrics	Syslog, Forwarded	Event format: LEEF Recorded event types: All DLC Metrics event types	Yes	No	No
IBM	IBM Federated Directory Server V7.2.0.2 and later	LEEF	FDS Audit	Yes	No	No
IBM	IBM Guardium® 8.2p45	Syslog	Policy builder events	No	No	No
IBM	IBM Security Guardium Insights	Syslog	Out of Box Policy Violation Rules	Yes	No	No
IBM	IBM i DSM V5R4 and later (formerly known as AS/400iSeries)	Log File Protocol	Event format: CEF (CEF:0 is supported.) LEEF (LEEF:1.0 is supported.) Recorded event types: All security events	No	Yes	No
IBM	IBM i - Robert Townsend Security Solutions V5R1 and later (formerly known as AS/400iSeries)	Syslog	Event format: CEF (CEF:0 is supported.) LEEF (LEEF:1.0 is supported.) Recorded event types: All security events	Yes	Yes	No
IBM	IBM i - Powertech Interact V5R1 and later (formerly known as AS/400iSeries)	Syslog	Event format: CEF (CEF:0 is supported.) LEEF (LEEF:1.0 is supported.) Recorded event types: All security events	Yes	Yes	No
IBM	IBM ISS Proventia M10 v2.1_2004.1122_15.13.53	SNMP	All events	No	No	No
IBM	IBM Lotus® Domino® v8.5	SNMP	All events	No	No	No
IBM	IBM Proventia Management SiteProtector v2.0 and v2.9	JDBC	IPS and audit events	No	No	No
IBM	IBM RACF® v1.9 to v1.13	Log File Protocol	All events	No	No	Yes
IBM	IBM CICS® v3.1 to v4.2	Log File Protocol	All events	No	No	Yes
IBM	IBM DB2® v8.1 to v10.1	Log File Protocol	All events	No	No	Yes
IBM	IBM DataPower® FirmwareV6 and V7 (formerly known as WebSphere® DataPower)	Syslog	All events	Yes	No	No
IBM	IBM MaaS360® Security (formerly known as IBM Fiberlink® MaaS360)	LEEF, JSON	Compliance rule events Device enrollment events Action history events	No	Yes	No
IBM	IBM QRadar Packet Capture IBM QRadar Packet Capture V7.2.3 to V7.2.8 IBM QRadar Network Packet Capture V7.3.0	Syslog, LEEF	All events	Yes	No	No
IBM	IBM Red Hat® OpenShift® V5.2.4	Syslog	Event format: JSON Event types: Audit and Infrastructure	Yes	No	Yes
IBM	IBM SAN Volume Controller	Syslog	CADF event format Activity, Control, and Monitor audit events	Yes	No	No
IBM	IBM z/OS v1.9 to v1.13	Log File Protocol	All events	No	No	Yes
IBM	IBM Informix® v11	Log File Protocol	All events	No	No	No
IBM	IBM IMS	Log File Protocol	All events	No	No	No
IBM	Security Access Manager for Mobile (ISAM)	TLS Syslog	IBM_SECURITY_AUTHN IBM_SECURITY_TRUST IBM_SECURITY_RUNTIME IBM_SECURITY_CBA_AUDIT _MGMT IBM_SECURITY_CBA_AUDIT _RTE IBM_SECURITY_RTSS_AUDI T_AUTHZ IBM_SECURITY_SIGNING CloudOE Operations Usage IDaaS Appliance Audit IDaaS Platform Audit	Yes	No	No
IBM	Security Identity Governance (ISIG)	JDBC	NVP event format Audit event type	No	No	No
IBM	QRadar Network Security XGS v5.0 with fixpack 7 to v5.4	Syslog	System, access, and security events	Yes	No	No
IBM	Security Network IPS (GX) v4.6 and later	Syslog	Security, health, and system events	Yes	No	No
IBM	Security Privileged Identity Manager V1.0.0 to V2.1.1	JDBC	Audit, authentication and system events	No	No	No
IBM	Security Identity Manager 6.0.x and later	JDBC	Audit and recertification events	No	Yes	No
IBM	IBM Security Randori Recon	IBM Security Randori REST API	Event format: JSON Event types: Detections	Yes	No	No
IBM	IBM Security QRadar EDR v3.9.0 (formerly known as IBM Security ReaQta)	IBM Security ReaQta REST API	Event format: JSON Event types: Alerts	Yes	No	Yes
IBM	IBM Security Trusteer®	HTTP Receiver	Event format: JSON Event types: Trusteer alerts	Yes	No	No
IBM	IBM Security Trusteer Apex™ Advanced Malware Protection	Syslog/LEEF Log File Protocol	Malware Detection Exploit Detection Data Exfiltration Detection Lockdown for Java™ Event File Inspection Event Apex Stopped Event Apex Uninstalled Event Policy Changed Event ASLR Violation Event ASLR Enforcement Event Password Protection Event	Yes	Yes	No
IBM	IBM Sense v1	Syslog	LEEF	Yes	No	No
IBM	IBM SmartCloud Orchestrator v2.3 FP1 and later	IBM SmartCloud Orchestrator REST API	Audit Records	No	Yes	No
IBM	IBM Security Verify (formerly known as IBM Cloud Identity)	JSON	Authentication SSO Management Threat	No	Yes	Yes
IBM	Tivoli® Access Manager IBM Web Security Gateway v7.x	Syslog	audit, access, and HTTP events	Yes	Yes	No
IBM	Tivoli Endpoint Manager (now known asIBM BigFix)
IBM	WebSphere Application Server v5.0 to v8.5	Log File Protocol	All events	No	Yes	No
IBM	WebSphere DataPower (now known as DataPower) WebSphere DataPower
IBM	zSecure Alert v1.13.x and later	UNIX syslog	Alert events	Yes	Yes	No
IBM	Security Access Manager v8.1 and v8.2	Syslog	Audit, system, and authentication events	Yes	No	No
IBM	Security Directory Server v6.3.1 and later	Syslog LEEF	All events	Yes	Yes	No
Illumio	Illumio Adaptive Security Platform	Syslog LEEF	Audit Traffic	Yes	No	No
Imperva	Incapsula	LEEF	Access events and Security alerts	Yes	No	No
Imperva	SecureSphere v6.2 and v7.x to v13 Release Enterprise Edition (Syslog) SecureSphere v9.5 to v13 (LEEF) cy	Syslog LEEF	Firewall policy events	Yes	No	No
Infoblox NIOS	Infoblox NIOS 6.x to 8.x	Syslog	ISC Bind Linux® DHCP Linux Server Apache	No	Yes	No
Internet Systems Consortium (ISC)	ISC BIND 9.9, 9.11, 9.12	Syslog	All events	Yes	No	No
Intersect Alliance	SNARE Enterprise Windows Agent	Syslog	Microsoft Event Logs	Yes	Yes	No
iT-CUBE	agileSI 1.x	SMB Tail	AgileSI SAP events	No	Yes	No
Itron	Openway Smart Meter	Syslog	All events	Yes	No	No
Juniper Networks	AVT	JDBC	All events	No	No	Yes
Juniper Networks	DDoS Secure Juniper Networks DDoS Secure is now known as NCC Group DDoS Secure.				No	No
Juniper Networks	DX The Juniper Networks DX Platform product is end of life (EOL), and is no longer supported by Juniper.	Syslog	Status and network condition events	Yes	No	Yes
Juniper Networks	Infranet Controller The Juniper Networks Infranet Controller DSM for IBM QRadar is now known as Pulse Secure Infranet Controller.
Juniper Networks	Firewall and VPN v5.5r3 and later	Syslog	NetScreen Firewall events	Yes	Yes	Yes
Juniper Networks	Junos WebApp Secure v4.2.x	Syslog	Incident and access events	Yes	No	No
Juniper Networks	IDP v4.0, v4.1 & v5.0	Syslog	NetScreen IDP events	Yes	No	Yes
Juniper Networks	Network and Security Manager (NSM) and Juniper SSG v2007.1r2 to 2007.2r2, 2008.r1, 2009r1.1, 2010.x	Syslog	NetScreen NSM events	Yes	No	Yes
Juniper Networks	Junos OS 7.x to 10.x Ex Series Ethernet Switch DSM only supports 9.0 to 10.x	Syslog or PCAP Syslog***	All events	Yes**	Yes	Yes
Juniper Networks	Secure Access Juniper Networks Secure Access is now known as Pulse Secure Pulse Connect Secure.					Yes
Juniper Networks	Juniper Security Binary Log Collector SRX or J Series appliances at 12.1 or above	Binary	Audit, system, firewall, and IPS events	No	No	Yes
Juniper Networks	Steel-Belted Radius 5.x	Log File	All events	Yes	Yes	Yes
Juniper Networks	vGW Virtual Gateway 4.5 The Juniper Networks vGW Virtual Gateway product is end of life (EOL), and is no longer supported by Juniper.	Syslog	Firewall, admin, policy and IDS Log events	Yes	No	No
Juniper Networks	Wireless LAN Controller Wireless LAN devices with Mobility System Software (MSS) V7.6 and later	Syslog	All events	Yes	No	No
Kisco	Kisco Information Systems SafeNet/i 10.11	Log File	All events	No	No	No
Kubernetes	Kubernetes Auditing	Syslog	Event format: JSON Recorded event types: RequestReceived, ResponseStarted, ResponseComplete	Yes	No	Yes
Lastline	Lastline Enterprise 6.0	LEEF	Anti-malware	Yes	No	No
Lieberman	Random Password Manager 4.8x	Syslog	All events	Yes	No	No
LightCyber	LightCyber Magna 3.9	Syslog, LEEF	C&C, exfilt, lateral, malware and recon	Yes	No	No
Linux	Open Source Linux OS 2.4 and later	Syslog	Operating system events	Yes	Yes	No
Linux	DHCP Server 2.4 and later	Syslog	All events from a DHCP server	Yes	Yes	No
Linux	IPtables kernel 2.4 and later	Syslog	Accept, Drop, or Reject events	Yes	No	No
McAfee	McAfee Application / Change Control v4.5.x	JDBC	Change management events	No	Yes	No
McAfee	McAfee ePolicy Orchestrator 3.5 to 5.10	JDBC: 3.5 to 5.9 SNMPv1, SNMPv2, SNMPv3: 3.5 to 5.9 TLS Syslog: 5.10	AntiVirus events	No	No	No
McAfee	McAfee MVISION Cloud 2.4 and 3.3 (formerly known as Skyhigh Networks Cloud Security Platform)	Syslog	Event format: Log Event Extended Format (LEEF) Recorded event types: Privilege Access, Insider Threat, Compromised Account, Access, Admin, Data, Policy, and Audit	Yes	No	No
McAfee	McAfee Network Security Platform 2.x - 5.x (Formerly known as McAfee Intrushield)	Syslog	Alert notification events Important: Supported alert notification events do not include custom events with IDs that begin with Oxc, Oxcc, Oxe, or Oxee.	Yes	No	No
McAfee	McAfee Network Security Platform 6.x - 7.x and 8.x - 10.x (Formerly known as McAfee Intrushield)	Syslog	Alert and fault notification events Important: Supported alert notification events do not include custom events with IDs that begin with Oxc, Oxcc, Oxe, or Oxee.	Yes	No	No
McAfee	McAfee Web Gateway 6.0.0	Syslog Log File protocol	Event format: LEEF Recorded event types: All events	Yes	No	No
MetaInfo	MetaIP 5.7.00-6059	Syslog	All events	Yes	Yes	No
Microsoft	Microsoft 365 Defender® Important: The Microsoft Windows Defender ATP DSM is now the Microsoft 365 Defender DSM. The DSM RPM name remains as Microsoft Windows Defender ATP in QRadar.	Microsoft Defender for Endpoint SIEM REST API Microsoft Azure Event Hubs Microsoft Graph Security API	Event format: JSON The Microsoft 365 Defender DSM supports the following events when you use the Microsoft Azure Event Hubs protocol: Alerts (Alerts are supported only for Microsoft Defender for Endpoint.): AlertInfo AlertEvidence Device: DeviceInfo DeviceNetworkInfo DeviceProcessEvents DeviceNetworkEvents DeviceFileEvents DeviceRegistryEvents DeviceLogonEvents DeviceEvents DeviceFileCertificateInfo DeviceImageLoadEvents Email: EmailEvents EmailAttachmentInfo EmailPostDeliveryEvents EmailUrlInfo The Microsoft 365 Defender DSM supports the following events when you use the Microsoft Defender for Endpoint REST API protocol: Windows Defender ATP Windows Defender AV Third party TI Customer TI Bitdefender The Microsoft 365 Defender DSM supports the following events when you use the Microsoft Graph Security API protocol: Microsoft Defender for Endpoint Alerts V2 Microsoft Defender for Cloud App Security Alerts V2 Microsoft Defender for Identity Alerts V2 Microsoft Defender for Office 365 Alerts V2 Microsoft Defender for Azure AD Identity Protection Alerts V2 Microsoft Defender for Data Loss Prevention Alerts V2	Yes	Yes	No
Microsoft	Microsoft Azure Active Directory	Microsoft Azure Event Hubs	Event format: JSON Recorded event types: Sign-In logs, Audit logs	Yes	No	No
Microsoft	Microsoft Azure Platform	Microsoft Azure Event Hubs	Event format: JSON Recorded event types: Platform level activity logs For more information about Platform level activity logs, see Azure Resource Manager resource provider operations (https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations). Note: This DSM automatically discovers only Activity Log Events that are forwarded directly from the Activity Log to the Event Hub.	Yes	No	No
Microsoft	Microsoft Defender for Cloud Important: The Microsoft Azure Security Center DSM is now the Microsoft Defender for Cloud DSM. The DSM RPM name remains as Microsoft Azure Security Center in QRadar.	Microsoft Graph Security API Microsoft Azure Event Hubs	Event format: JSON Recorded event types: Security alert	No	No	No
Microsoft	DNS Debug Supported versions: Windows Server 2016, Windows Server 2012 R2, Windows Server 2008 R2	WinCollect Microsoft DNS Debug	LEEF	Yes	Yes	No

Microsoft	IIS 6.0, 7.0 and 8.x	Syslog and WinCollect	HTTP status code events	Yes	No	No
Microsoft	Internet and Acceleration (ISA) Server or Threat Management Gateway 2006	Syslog and WinCollect	ISA or TMG events	Yes	No	No
Microsoft	Microsoft Exchange Server 2003, 2007, 2010, 2013, 2016 and 2019	Windows Exchange Protocol	Outlook Web Access events (OWA) Simple Mail Transfer Protocol events (SMTP Message Tracking Protocol events (MSGTRK)	No	No	No
Microsoft	Endpoint Protection 2012	JDBC	Malware detection events	No	No	No
Microsoft	Microsoft Hyper-V supported versions: Windows Server 2016 Windows Server 2012 (most recent) Windows Server 2012 Core Windows Server 2008 (most recent) Windows Server 2008 Core Windows 10 (most recent) Windows 8 (most recent) Windows 7 (most recent) Windows Vista (most recent)	WinCollect	All events	No	No	No
Microsoft	IAS Server v2000, 2003, and 2008	Syslog	All events	Yes	No	No
Microsoft	Microsoft Office 365	Office 365 REST API	JSON	No	No	No
Microsoft	Microsoft Office 365 Message Trace	Office 365 Message Trace REST API	Event format: JSON Event types: Email security threat classification	No	No	No
Microsoft	Microsoft Windows Defender ATP	Microsoft Defender for Endpoint REST API	Event format: JSON Event types: Windows Defender ATP Windows Defender AV Third Party TI Customer TI Bitdefender	No	No	No
Microsoft	Microsoft Windows Security Event Log supported versions: Windows Server 2016 Windows Server 2012 (most recent) Windows Server 2012 Core Windows Server 2008 (most recent) Windows Server 2008 Core Windows 10 (most recent) Windows 8 (most recent) Windows 7 (most recent) Windows Vista (most recent)	Syslog Forwarded TLS Syslog TCP Multiline Syslog Windows Event Log (WMI) Windows Event Log Custom (WMI) MSRPC WinCollect WinCollect NetApp Data ONTAP	All events, including Sysmon and winlogbeats.json	Yes	Yes	Yes
Microsoft	SQL Server 2008, 2012, 2014 (Enterprise editions only), and 2016	Syslog, JDBC and WinCollect	SQL Audit events	No	No	No
Microsoft	SharePoint 2010 and 2013	JDBC	SharePoint audit, site, and file events	No	No	No
Microsoft	DHCP Server 2000/2003	Syslog and WinCollect	All events	Yes	Yes	No
Microsoft	Operations Manager 2005	JDBC	All events	No	No	No
Microsoft	System Center Operations Manager 2007	JDBC	All events	No	No	No
Motorola	Symbol AP firmware 1.1 to 2.1	Syslog	All events	No	No	No
NCC Group	NCC Group DDos 5.13.1-2s to 516.1-0	Syslog	Event format: LEEF Event types: All events	Yes	No	No
Niara	Niara 1.6	Syslog	Security System Internal Activity Exfiltration Infection Command & Control	Yes	No	Yes
NetApp	Data ONTAP	WinCollect NetApp Data ONTAP	CIFS events	Yes	Yes	No
Netgate	Netgate pfSense	Syslog	System Firewall DNS DHCP (when you use the Linux DHCP DSM)	Yes	Yes	No
Netskope	Netskope Active Important: The IBM QRadar DSM for Netskope Active is deprecated. To continue taking advantage of this integration, please download the Netskope Security Cloud DSM from the IBM Security App Exchange website (https://exchange.xforce.ibmcloud.com/hub/extension/ff97aaadc10ed96b0e05d1a1f24af2f7).	Netskope Active REST API	Alert, All events	No	Yes	No
NGINX	NGINX HTTP Server 1.15.5	Syslog	Syslog, Standard syslog	Yes	No	No
Niksun	NetVCR 2005 v3.x	Syslog	Niksun events	No	No	No
Nokia	Firewall NG FP1, FP2, FP3, AI R54, AI R55, NGX on IPSO v3.8 and later	Syslog or OPSEC LEA	All events	Yes	Yes	No
Nokia	VPN-1 NG FP1, FP2, FP3, AI R54, AI R55, NGX on IPSO v3.8 and later	Syslog or OPSEC LEA	All events	Yes	Yes	No
Nominum	Vantio v5.3 Note: The Nominum Vantio DSM for QRadar is deprecated.
Nortel	Contivity	Syslog	All events	Yes	No	No
Nortel	Application Switch v3.2 and later	Syslog	Status and network condition events	No	Yes	No
Nortel	ARN v15.5	Syslog	All events	Yes	No	No
Nortel*	Ethernet Routing Switch 2500 v4.1	Syslog	All events	No	Yes	No
Nortel*	Ethernet Routing Switch 4500 v5.1	Syslog	All events	No	Yes	No
Nortel*	Ethernet Routing Switch 5500 v5.1	Syslog	All events	No	Yes	No
Nortel	Ethernet Routing Switch 8300 v4.1	Syslog	All events	No	Yes	No
Nortel	Ethernet Routing Switch 8600 v5.0	Syslog	All events	No	Yes	No
Nortel	VPN Gateway v6.0, 7.0.1 and later, v8.x	Syslog	All events	Yes	Yes	No
Nortel	Secure Router v9.3, v10.1	Syslog	All events	Yes	Yes	No
Nortel	Secure Network Access Switch v1.6 and v2.0	Syslog	All events	Yes	Yes	No
Nortel	Switched Firewall 5100 v2.4	Syslog or OPSEC	All events	Yes	Yes	No
Nortel	Switched Firewall 6000 v4.2	Syslog or OPSEC	All events	Yes	Yes	No
Nortel	Threat Protection System v4.6 and v4.7	Syslog	All events	No	No	No
Novell	eDirectory v2.7	Syslog	All events	Yes	No	No
ObserveIT	ObserveIT 5.7.x and later	JDBC	Alerts User Activity System Events Session Activity DBA Activity	No	Yes	No
Okta	Okta Identity Management	Okta REST API	JSON	No	Yes	No
Onapsis	Onapsis Security Platform v1.5.8 and later	Log Event Extended Format (LEEF)	Assessment Attack signature Correlation Compliance	Yes	No	No
OpenBSD Project	OpenBSD v4.2 and later	Syslog	All events	No	Yes	No
Open Information Security Foundation (OISF)	Suratica v6.0.3 and earlier	Syslog TLS Syslog	Event format: JSON Recorded event types: Alerts	Yes	No	No
Open LDAP Foundation	Open LDAP 2.4.x	UDP Multiline Syslog	All events	No	No	No
Open Source	SNORT v2.x	Syslog	All events	Yes	No	No
OpenStack	OpenStack v2015.1	HTTP Reciever	Audit events	No	No	No
Oracle	Oracle RDBMS Audit Record versions 9i, 10g, 11g, 12c (includes unified auditing)	JDBC, Syslog	Event format: Name-Value Pair Recorded event types: Audit records	Yes	Yes	No
Oracle	Audit Vault V10.3 and V12.2	JDBC	All audit records from the AVSYS.AV$ALERT_STORE table for V10.3, or from the custom AVSYS.AV_ALERT_STORE_V view for V12.2.	No	Yes	No
Oracle	Oracle OS Audit 9i, 10g, and 11g	Syslog	Event format: name-value pair (NVP) Event types: Oracle events	Yes	Yes	No
Oracle	Oracle BEA WebLogic 12.2.1.3.0	Log File	Oracle events	No	No	No
Oracle	Oracle Database Listener 9i, 10g, and 11g	Syslog	Oracle events	Yes	No	No
Oracle	Oracle Directory Server (Formerly known as Sun ONE LDAP).
Oracle	Oracle Fine Grained Auditing 9i and 10g	JDBC	Select, insert, delete, or update events for tables configured with a policy	No	No	No
N/A	osquery 3.3.2	Syslog TCP Multiline Syslog	Event format: JSON Event type: Access Audit Authentication System	No	No	Yes
OSSEC	OSSEC 2.6 and later	Syslog	All relevant	Yes	No	No
Palo Alto Networks	Palo Alto PA Series	Syslog TLS Syslog	Event types: Traffic Threat Config System HIP Match Authentication Tunnel Inspection (for PAN-OS 8.0 - 9.1) or Tunnel (for PAN-OS 10.0) Correlation SCTP File Data GTP HIP Match IP-Tag Global Protect - Important: To use this log type, you must enable the EventStatus/Status field on your Palo Alto PA Series device. Decryption User ID URL Filtering (for PAN-OS 8.0 - 9.1) or URL (for PAN-OS 10.0) WildFire Event Formats: LEEF for PAN-OS v3.0 to v10.2, and Prisma Access v2.1 CEF for PAN-OS v4.0 to v6.1 (CEF:0 is supported)	Yes	Yes	No
Palo Alto Networks	Palo Alto Endpoint Security Manager 3.4.2.17401	Syslog	Agent Config Policy System Threat Event formats: CEF (CEF:0 is supported), LEEF	Yes	No	No
Ping Identity	PingFederate	Syslog	Event format: CEF	Yes	No	No
Pirean	Access: One 2.2 with DB2 9.7	JDBC	Access management and authentication events	No	No	No
PostFix	Mail Transfer Agent 2.6.6 and later	UDP Multiline Protocol or Syslog	Mail events	No	No	No
ProFTPd	ProFTPd 1.2.x, 1.3.x	Syslog	All events	Yes	Yes	No
Proofpoint	Proofpoint Enterprise Protection and Enterprise Privacy versions 7.0.2, 7.1, 7.2, 7.5, 8.0	Syslog Log File	Event types: System Email security threat classification Email audit and encryption	No	No	No
Pulse Secure	Pulse Secure Infranet Controller 2.1, v3.1 and 4.0	Syslog	All events	No	Yes	Yes
Pulse Secure	Pulse Secure Pulse Connect Secure 8.2R5	Syslog TLS Syslog	Event types: Admin Authentication System Network Error	Yes	Yes	Yes
Radware	AppWall 6.5.2 and 8.2	Syslog	Event types: Administration Audit Learning Security System	Yes	No	No
Radware	DefensePro 4.23, 5.01, 6.x and 7.x	Syslog	All events (Event mapping is required when Event IDs are 300,000 or more.) Tip: If you have custom events that display as unknown in QRadar, see the IBM Support article about QRadar: Custom events for Radware DefensePro display 'parsed, but not mapped' (https://www.ibm.com/support/pages/node/6960301).	Yes	No	No
Raz-Lee iSecurity	IBM i Firewall 15.7 and Audit 11.7	Syslog	Security, compliance, firewall, and audit events	Yes	Yes	No
Redback Networks	ASE 6.1.5	Syslog	All events	Yes	No	No
Red Hat	Red Hat Advanced Cluster Security for Kubernetes	HTTP Receiver	JSON Recorded event types: audit and alert events	Yes	No	No
Resolution1	Resolution1 CyberSecurity Formerly known as AccessData InSight Resolution1 CyberSecurity.	Log file	Volatile Data, Memory Analysis Data, Memory Acquisition Data, Collection Data, Software Inventory, Process Dump Data, Threat Scan Data, Agent Remediation Data	No	No	No
Riverbed	SteelCentral NetProfiler	JDBC	Alert events	No	No	No
Riverbed	SteelCentral NetProfiler Audit	Log file protocol	Audit events	No	Yes	No
RSA	Authentication Manager 6.x, 7.x, and 8.x	v6.x and v7.x use Syslog or Log File Protocol v8.x uses Syslog only	All events	No	No	No
SafeNet	DataSecure 6.3.0 and later	Syslog	All events	Yes	No	No
Salesforce	Salesforce Security Auditing	Log File	Setup Audit Records	No	No	No
Salesforce	Salesforce Security	Salesforce REST API Protocol	Login History Account History Case History Entitlement History Service Contract History Contract Line Item History Contract History Contact History Lead History Opportunity History Solution History Salesforce Security Auditing audit trail	No	Yes	No
Samhain Labs	HIDS 2.4	Syslog JDBC	All events	Yes	No	No
SAP	SAP Enterprise Threat Detection V1.0 SP6 to V2.0 SP5	SAP Enterprise Threat Detection Alert API	LEEF	No	No	No
Seculert	Seculert v1	Seculert Protection REST API Protocol	All malware communication events	No	No	No
Seculert	Seculert	Seculert protection REST API Protocol	All malware communication events	No	No	No
Sentrigo	Hedgehog 2.5.3	Syslog	All events	Yes	No	No
Skyhigh Networks (now known as McAfee)	Skyhigh Networks Cloud Security Platform 2.4 and 3.3 (now known as McAfee MVISION Cloud 2.4 and 3.3)
SolarWinds	SolarWinds Orion 2011.2	Syslog	All events	No	No	No
SonicWALL	UTM/Firewall/VPN Appliance 3.x and later	Syslog	All events	Yes	No	No
Sophos	Sophos Astaro Security Gateway 17.x	Syslog	All events	Yes	No	No
Sophos	Sophos Enterprise Console 4.5.1 and 5.1	Sophos Enterprise Console protocol JDBC protocol	All relevant anti-virus events	No	No	No
Sophos	Sophos PureMessage 3.1.0.0 for Microsoft Exchange 5.6.0 for Linux	JDBC	Quarantined email events	No	No	No
Sophos	Sophos Web Security Appliance 3.x	Syslog	Transaction log events	Yes	No	No
Sourcefire	Sourcefire Intrusion Sensor IS 500, 2.x, 3.x, 4.x	Syslog	All events	Yes	No	No
Sourcefire	Sourcefire Defense Center (Now known as Cisco FireSIGHT Mangement Center)
Splunk	MicrosoftWindows Security Event Log	Windows-based event provided by Splunk Forwarders	All events	No	Yes	No
Squid	Squid Web Proxy 2.5 and later	Syslog	All cache and access log events	Yes	No	No
Startent Networks	Startent Networks	Syslog	All events	Yes	No	No
STEALTHbits Technologies	STEALTHbits File Activity Monitor	Syslog LEEF	File Activity Monitor Events
STEALTHbits Technologies	StealthINTERCEPT	Syslog LEEF	Active Directory Audit Events	Yes	No	No
STEALTHbits Technologies	STEALTHbits StealthINTERCEPT Alerts	Syslog LEEF	Active Directory Alerts Events	Yes	No	No
STEALTHbits Technologies	STEALTHbits StealthINTERCEPT Analytics	Syslog LEEF	Active Directory Analytics Events	Yes	No	No
Sun	Sun Solaris DHCP 2.8	Syslog	All events	Yes	Yes	No
Sun	Sun Solaris OS 5.8, 5.9	Syslog	All events	Yes	Yes	No
Sun	Sun Solaris Sendmail 2.x	Syslog Log File Protocol Proofpoint 7.5 and 8.0 Sendmail log	All events	Yes	No	No
Sun	Sun Solaris Basic Security Mode (BSM) 5.10 and 5.11	Log File Protocol	All events	No	Yes	No
Sun	Sun ONE LDAP v11.1 (Known as Oracle Directory Server)	Log File Protocol UDP Multiline Syslog	All relevant access and LDAP events	No	No	No
Sybase	Sybase ASE 15.0 and later	JDBC	All events	No	No	No
Symantec	Symantec Endpoint Protection 11, 12, and 14	Syslog	All Audit and Security Logs	Yes	No	Yes
Symantec	Symantec SGS Appliance 3.x and later	Syslog	All events	Yes	No	Yes
Symantec	Symantec SSC 10.1	JDBC	All events	Yes	No	No
Symantec	Symantec Data Loss Prevention (DLP) 8.x	Syslog	All events	No	No	No
Symantec	Symantec Encryption Management Server 3.0x formerly known as PGP Universal Server	Syslog	All events	Yes	No	No
Symark	Symark PowerBroker 4.0	Syslog	All events	Yes	No	No
SysFlow is an open source project initiated by IBM.	SysFlow 1.0	Syslog	Event format: JSON Recorded event types: SysFlow	Yes	No	No
ThreatGRID	Malware Threat Intelligence Platform 2.0	Log file protocol Syslog	Malware events	No	No	No
TippingPoint	Intrusion Prevention System (IPS) 1.4.2 to 3.2.x TippingPoint SMS 5.2.0	Syslog	All events	No	No	No
TippingPoint	X505/X506 2.5 and later	Syslog	All events	Yes	Yes	No
Top Layer	IPS 5500 4.1 and later	Syslog	All events	Yes	No	No
Trend Micro	Trend Micro Apex Central (version 1)	Syslog, TLS syslog	Event format: CEF Event types: Attack discovery detection logs Behavior monitoring logs C&C callback logs Content security logs Data loss prevention logs Device access control logs Endpoint application control logs Engine update status logs Intrusion prevention logs Network content inspection logs Pattern Update Status Logs Predictive machine learning logs Sandbox detection logs Spyware/Grayware logs Suspicious file logs Virus/Malware logs Web security logs	Yes	No	No
Trend Micro	Trend Micro Apex One 8.x and 10.x Formerly known as Trend Micro Office Scan. The name remains the same in QRadar.	SNMPv2	All events	No	No	No
Trend Micro	Trend Micro Control Manager 5.0 or 5.5 with hotfix 1697 or hotfix 1713 after SP1 Patch 1; 6.0 and 7.0.	SNMPv1 SNMPv2 SNMPv3	All events	Yes	No	No
Trend Micro	Trend Micro Deep Discovery Analyzer 5.0, 5.5, 5.8 and 6.0	Syslog	Event format: LEEF Events: All events	Yes	No	No
Trend Micro	Trend Micro Deep Discovery Director 3.0	Syslog	Event format: LEEF Events: Trend Micro Deep Discovery Inspector events	Yes	No	No
Trend Micro	Trend Micro Deep Discovery Email Inspector 3.0	Syslog	Event format: LEEF Events: Detections, Virtual Analyzer Analysis logs, System events, Alert events	Yes	No	No
Trend Micro	Trend Micro Deep Discovery Inspector 3.0 to V3.8, 5.0 and 5.1	Syslog	Event format: LEEF Events: Malicious content Malicious behavior Suspicious behavior Exploit Grayware Web reputation Disruptive application Sandbox Correlation System Update	Yes	No	No
Trend Micro	Trend Micro Deep Security 9.6.1532 to 12.0	Syslog	Event format: LEEF Events: Anti-Malware Deep Security Firewall Integrity Monitor Intrusion Prevention Log Inspection System Web Reputation	Yes	No	No
Tripwire	Tripwire Enterprise Manager 5.2 and later	Syslog	Event format: CEF (CEF:0 is supported) Event types: Resource additions, removal, and modification events	Yes	No	No
Tropos Networks	Tropos Control 7.7	Syslog	Fault management, login/logout, provision, and device image upload events	No	No	No
Trusteer	Apex Local Event Aggregator 1304.x and later	Syslog	Malware, exploit, and data exfiltration detection events	Yes	No	No
Vectra Networks	Vectra Networks Vectra v2.2 Important: The IBM QRadar DSM for Vectra Networks Vectra is deprecated. To continue taking advantage of this integration, please download the Vectra Networks Vectra DSM from the IBM Security App Exchange website (https://exchange.xforce.ibmcloud.com/hub/extension/47f3e9afff5e0281d6684bb633d769f2).	Syslog	Host scoring, command and control, botnet activity, reconaissance, lateral movement, exfiltration Event format: CEF (CEF:0 is supported)	Yes	No	No
Verdasys	Digital Guardian 6.0.x (Syslog only) Digital Guardian 6.1.1 and 7.2 (LEEF only)	Syslog	Event format: LEEF Events: All events	Yes	No	No
Vericept	Content 360 up to 8.0	Syslog	All events	Yes	No	No
VMware	VMware AppDefense 1.0	JSON VMWare AppDefense API protocol	All events	No	No	No
VMware	Carbon Black App Control 8.0.x to 8.5.x (Formerly known as Carbon Black Protection)	Syslog	Event format: LEEF Event types: computer management, server management, session management, policy management, policy enforcement, internal events, general management, discovery	Yes	Yes	No
VMware	VMware ESX or ESXi 3.x, 4.x, 5.x and 6.x	Syslog EMC VMware protocol	Account Information Notice Warning Error System Informational System Configuration System Error User Login Misc Suspicious Event Access Denied License Expired Information Authentication Session Tracking	Yes if syslog	No	No
VMware	VMware vCenter v5.x and v6.x	EMC VMware protocol	Account Information Notice Warning Error System Informational System Configuration System Error User Login Misc Suspicious Event Access Denied License Expired Information Authentication Session Tracking	No	No	No
VMware	VMware vCloud Director 5.1 - 10.0	VMware vCloud Director protocol	All events	No	Yes	No
VMware	VMware vShield	Syslog	All events	Yes	No	No
Vormetric, Inc.	Vormetric Data Security	Syslog (LEEF)	Audit Alarm Warn Learn Mode System	Yes	No	No
Watchguard	WatchGuard Fireware OS	Syslog	All events	Yes	No	No
Websense (now known as Forcepoint)
Zscaler	Zscaler Nanolog Streaming Service (Zscaler NSS) 6.0	Syslog HTTP receiver Important: When you use the HTTP receiver protocol with Zscaler NSS, you need a certificate that is issued by a certificate authority (CA). It can't be a self-signed certificate because it must be validated by a CA. For more information about certificates and configuring the log source parameters for HTTP receiver, see HTTP Receiver protocol configuration options.	Event format: LEEF Event types: Web log events, Firewall events (including DNS)	Yes	No	No
Zscaler	Zscaler Private Access	Syslog	Event format: LEEF Event types: User Status, App Connector Status, Audit, User Activity	Yes	No	No