Creating or editing a log source mapping

If IBM QRadar Risk Manager cannot identify a log source in QRadar, you can configure a log source mapping.

Procedure

  1. Click the Risks tab.
  2. In the navigation pane, click Configuration Monitor.
  3. Click the device that doesn’t have a log source mapping.
  4. On the toolbar, click Action > Log Source Mapping > Create/Edit Log Source Mapping.
  5. In the Log Source Groups list, select a group.
  6. In the Log Sources list, select a log source and click (>).
  7. Click OK.