(It was really nice to learn that my tiny Gaulish setup is far ahead of the mothership when it comes to app monitoring, and they want to grab the cooked stuff from my setup). Have not talked to the tech guys yet, I am currently just trying to be prepared for the first meeting. I know Splunk is flexible, but the first I heard of the QRadar guys was Syslog, which seems inelegant for reports/alerts. If that is the form of the option your organization wants to take, it would be better policy for Qradar to configure another port to receive from Splunk, rather than using that one, but that decision is out of your hands. (Not saying that's a great idea, just saying it's a feasible option.) If you wanted, you could use a script to throw the Splunk output at that same port. The question then becomes, 'In what form and method is Qradar willing and able to receive data?'įrom the answer to that, you back into 'which method do I prefer to send that data?'įor instance, Qradar can receive logs from syslog-ng on port 514.

(The script could save the results, transmit them, or translate them.) (Also several ways)ģ) You can always run a script when an alert is triggered. (Several ways)Ģ) You can always get the stuff that lands in a place to be picked up and sent to an application. There are an 'embarrassment of riches' in how many ways you can do that.ġ) You can always output the results of a scheduled search to a place on the box or the local net.

Splunk qradar