IBM QRadar
Connection Requirements
SEC Token
On the Admin tab, click Authorized Services in the User Management section.
In the Authorized Services window, click Add Authorized Service.
Add the relevant information in the following fields and click Create Service:
In the Service Name field, type a name for this authorized service.
From the User Role list, select the user role that you want to use.
From the Security Profile list, select the security profile that you want to assign to this authorized service.
In the Expiry Date list, type or select a date that you want this service to expire. If an expiry date is not necessary, select No Expiry.
Click Create Service.
🔵 Note To authenticate as an authorized service, you create an authentication token that uses authorized services. IBM QRadar authorized services have roles and security profiles assigned that control access to the various API resources.
Separator
To accurately extract hostnames in IBM QRadar, it's important to define a pattern. This helps OctoXLabs handle various naming conventions. You can specify the hostname field using separators. If multiple scenarios apply, the separator patterns can be divided with a comma (",").
Examples:
For "hostname @ some data":
{{ hostname }} @For "windows --- hostname --- logs":
---{{ hostname }}---
By default, it is set to hostname @.
⚠️ Attention Please perform a connection test to ensure there is a valid connection to the host. When the discovery operation is finalized, you will be able to see the details on the Assets page.