QRadar parsing

Question

When you send your log file data to IBM Security QRadar, it first is parsed inside a Device Support Module (DSM) so that QRadar can fully utilize the normalized data for event and offense processing. Sometimes you encounter data that cannot be correctly parsed, or you are dealing with multiple log sources running on one physical system. 

In this course, Jose Bravo reviews the basic processes inside a QRadar DSM and explains how events are flagged. He demonstrates how to find the correct parser for your log source, and how to handle the parsing order in case you have deployed more than one log source on a physical machine.

Using the attached additional resources, you can run these scenarios on your own QRadar Community Edition (or other QRadar) deployment.

• Introduction
  
• When parsing does not work
• SIM Generic
• Stored and Unknown
• Parsing order intro and examples 
• Syslog redirect
• Property formats
• Setting the lab up