Syslog (CEF)

IBM QRadar

Add a log source of type Universal CEF pointed at the QRadar event collector. Events map with DeviceVendor Securd.

Integration steps for IBM QRadar

Turn on syslog forwarding

In the console, under Settings, Log Forwarding, set the collector host and port. Events are forwarded in real time. This is the method for continuous ingestion; the API export is for backfill and ad hoc retrieval.

Settings > Log Forwarding

Syslog host: collector.example.internal
Syslog port: 514

Log source

Under Admin, Log Sources, add a log source of type Universal CEF with protocol Syslog. Set the identifier to the Securd forwarder address.

Verification

Two queries: one confirms ingestion, one lists first-seen destinations by policy.

Last 10 events arrived

text

SELECT * FROM events WHERE LOGSOURCETYPENAME(devicetype) = 'Universal CEF' AND "Vendor" = 'Securd' LAST 10 MINUTES

First-seen per source, last 24h

text

SELECT sourceip, COUNT(*) FROM events WHERE "Vendor" = 'Securd' AND "Event Name" = 'greywall' GROUP BY sourceip LAST 24 HOURS

Event reference Splunk Microsoft Sentinel Elastic Datadog Google SecOps (Chronicle)Sumo Logic Cribl Stream and OpenTelemetry Collector Splunk SOAR, Cortex XSOAR, Tines and Torq

Evaluate Agent DNS with your own agent traffic

Forward events from a single policy and review them with your security team.

See It Live View Pricing