Syslog log source parameters for Broadcom Symantec SiteMinder

If QRadar does not automatically detect the log source, add a Broadcom Symantec SiteMinder log source on the QRadar Console by using the Syslog protocol.

When using the Syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from Symantec SiteMinder:

Table 1. Syslog log source parameters for the Symantec SiteMinder DSM
Parameter	Value
Log Source name	Type a name for your log source.
Log Source description	Type a description for the log source.
Log Source type	CA SiteMinder
Protocol Configuration	Syslog
Log Source Identifier	Type the IP address or host name for your Symantec SiteMinder appliance.
Enabled	Select this check box to enable the log source. By default, this check box is selected.
Credibility	From the list, type the credibility value of the log source. The range is 0 - 10. The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source device. Credibility increases if multiple sources report the same event. The default is 5.
Target Event Collector	From the list, select the Target Event Collector to use as the target for the log source.
Coalescing Events	Select this check box to enable the log source to coalesce (bundle) events. Automatically discovered log sources use the default value that is configured in the Coalescing Events list in the System Settings window, which is accessible on the Admin tab. However, when you create a new log source or update the configuration for an automatically discovered log source that you can override the default value by configuring this check box for each log source. For more information, see the IBM® QRadar® Administration Guide.
Store Event Payload	Select this check box to enable or disable QRadar from storing the event payload. Automatically discovered log sources use the default value from the Store Event Payload list in the System Settings window, which is accessible on the Admin tab. When you create a new log source or update the configuration for an automatically discovered log source that you can override the default value by configuring this check box for each log source. For more information, see the IBM QRadar Administration Guide.