Skip to content

IBM QRadar via Fluentd

Example overview

Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:

  • Log collector: accepts logs from several sources and forwards logs to the SIEM system

  • SIEM system: used to analyze logs and monitor the system status

In the provided example, events are sent via webhooks to the Fluentd log collector and forwarded to the QRadar SIEM system.

Webhook flow

Used resources

Fluentd configuration

Fluentd is configured in the td-agent.conf file:

  • Incoming webhook processing is configured in the source directive:

    • All HTTP and HTTPS traffic is sent to 9880 Fluentd port
    • TLS certificate for HTTPS connection is located within the file /etc/pki/ca.pem
  • Forwarding logs to QRadar and log output are configured in the match directive:

    • All event logs are copied from Fluentd and forwarded to QRadar at the IP address https://109.111.35.11:514
    • Logs are forwarded from Fluentd to QRadar in the JSON format according to the Syslog standard
    • Connection with QRadar is established via TCP
    • Fluentd logs are additionally printed on the command line in JSON format (19-22 code lines). The setting is used to verify that events are logged via Fluentd
<source>
  @type http # input plugin for HTTP and HTTPS traffic
  port 9880 # port for incoming requests
  <transport tls> # certificates for HTTPS connection
    ca_path /etc/pki/ca.pem
  </transport>
</source>
<match **>
  @type copy
  <store>
      @type remote_syslog # output plugin to forward logs from Fluentd via Syslog
      host 109.111.35.11 # IP address to forward logs to
      port 514 # port to forward logs to
      protocol tcp # connection protocol
    <format>
      @type json # format of forwarded logs
    </format>
  </store>
  <store>
     @type stdout # output plugin to print Fluentd logs on the command line
     output_type json # format of logs printed on the command line
  </store>
</match>

A more detailed description of configuration files is available in the official Fluentd documentation.

Testing Fluentd configuration

To check that Fluentd logs are created and forwarded to QRadar, the PUT or POST request can be sent to Fluentd.

Request example:

curl -X POST 'https://fluentd‑example‑domain.com' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'

Fluentd logs:

Logs in Fluentd

QRadar logs:

Logs in QRadar

QRadar log payload:

Logs in QRadar

QRadar configuration (optional)

In QRadar, the log source is configured. It helps to easily find Fluentd logs in the list of all logs in QRadar, and can also be used for further log filtering. The log source is configured as follows:

  • Log Source Name: Fluentd

  • Log Source Description: Logs from Fluentd

  • Log Source Type: type of incoming logs parser used with Syslog standard Universal LEEF

  • Protocol Configuration: standard of logs forwarding Syslog

  • Log Source Identifier: Fluentd IP address

  • Other default settings

A more detailed description of QRadar log source setup is available in the official IBM documentation.

QRadar log source setup for Fluentd

Configuration of webhook integration

  • Webhooks are sent to https://fluentd-example-domain.com

  • Webhooks are sent via POST requests

  • Additional authentication parameter X-Auth-Token is passed in the request

  • Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

Webhook integration with Fluentd

Example testing

To test the configuration, a new user is added in Wallarm Console:

Adding user

Fluentd will log the event as follows:

Log about new user in QRadar from Fluentd

The following data in JSON format will be displayed in the QRadar log payload:

New user card in QRadar from Fluentd