Qradar to Elastic

Elastic Stack Logstash
1

We want to extend our Qradar to Elastic for threat hunting, so we intend on forwarding logs from Qradar to Elastic via log forwarding, via syslog or via JSON.

Since I cannot install any beats on QRadar Server, will forwarding logs through JSON help in easier parser creation.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.