Editing multiple log sources at the same time

In the QRadar® Log Source Management app, view and edit a number of log sources at the same time. Edit multiple log sources when the log sources have similar parameters that you want to change, instead of editing each log source individually.

Procedure

  1. In the QRadar Log Source Management app, select the relevant log sources that you want to edit.
    1. To edit all of your log sources, select the Select All checkbox and click Select all log sources.
  2. Click Edit.
  3. In the Log Source Summary pane, select and edit the parameters and click Save.
    Restriction: You cannot edit the Log Source Identifier parameter in bulk.
  4. In the Name Template and Description Template fields, use the available variables to create the names and descriptions of the selected log sources.
  5. Click the Protocol tab to edit the protocol parameters for the selected log sources. The selected log sources must share a protocol.
  6. Click Save.