Qradar Logs to Logstash/Elastic?

[mohamed_el_mannouti]

we have a Qradar SIEM which we plan to extend to Elastic for threat hunting(Log Forwarding from Qradar to Elastic)

Has anyone found any success with it. Any known shortcomings/pitfalls from the setup.

[leandrojmp (Leandro Pereira)]

QRadar can forward logs without any problem, you just need to choose how to forward it.

I do not use QRadar anymore, but I would recommend that you forward already in json to logstash, it will give you less work if need or want to transform your data before sending to elasticsearch.

[mohamed_el_mannouti]

thank you for your comment
Yes that do i want exactly but i don't know how i can do this.

[warkolm (Mark Walkom)]

Welcome to our community!

Please don't add unrelated tags to your topics in future