QRadar: Report on all Active Log Sources

Answer

As of QRadar 7.2.3, you can now create a report to list the status of your log sources, but you do not have the option to choose just enabled log sources.

Follow these steps to create the report on the status of your log sources:

1. Click the Reports tab.
   
2. Click Actions.
   
3. Click Create.
   
4. This will open up the Report Wizard.
   
5. Choose the Report Schedule and click Next.
   
   
   
6. Choose the Layout of the report and click Next.
   
   
   
7. Enter a Report Title in the text Box.
   
   
   
8. In the Chart Type drop-down menu, select Log Sources.
   
   
   
9. This will bring you to a new page. Under Log Sources, click the check box that says All log sources.
   
   
   
10. Under Data Options, set the Order by option to Status, and Ascending.
    
    This report will list all log sources, with the enabled log sources located at the top of the report.
    
    
    
    
11. For other Data Options including Enabled, Protocol, Target Collector, Auto Discovered, and Name select one of these options from the drop-down menu.