...
Log type | Format in Reflector | Filter regex (include) | Filter comments | Notes |
|---|---|---|---|---|
Apache Web Server | Syslog RFC 3164 (QRadar) | \tApacheLog\t | Set “Log Type” in log file policy as “Apache”. | |
Microsoft ADFS | Syslog RFC 3164 (QRadar) | AD FS/Admin | ||
Microsoft Defender | Syslog RFC 3164 (QRadar) | Microsoft-Windows-Windows Defender/Operational | ||
Microsoft DHCP | Syslog RFC 3164 (QRadar) | MSSQL\$MICROSOFT##WID|MSSQLSERVER | Replace MSSQLSERVER with instance name | Set “Log Type” in log file policy as “DHCP”. |
Microsoft DNS Server | Syslog RFC 3164 (QRadar) | \tMSDNSServer\t | Set “Log Type” in log file policy as “DNS”. | |
Microsoft Exchange Parser | Syslog RFC 3164 (QRadar) | \tExchangeLog\t | “Custom” Log type specified in policy. Set as "ExchangeLog". | |
Microsoft IIS Server | Syslog RFC 3164 (QRadar) | \tIISWebLog\t | Set “Log Type” in log file policy as “IIS”. | |
Microsoft Windows Powershell | Syslog RFC 3164 (QRadar) | Microsoft-Windows-PowerShell/Operational | ||
Microsoft Windows Snare Application | Syslog RFC 3164 (QRadar) | \t(Application|Security|System)\t\tMSWinEventLog\t | One desitnation and policy required for Security, Application and System | |
Microsoft Windows Snare Security | Syslog RFC 3164 (QRadar) | \tMSWinEventLogt(Application|Security|System)\t | See above | |
Microsoft Windows Snare System | Syslog RFC 3164 (QRadar) | \tMSWinEventLogt(Application|Security|System)\t | See above | |
Microsoft Windows Sysmon | Syslog RFC 3164 (QRadar) | Microsoft-Windows-Sysmon/Operational | ||
Microsoft Windows Sysmon | Syslog RFC 3164 (QRadar) | Microsoft-Windows-Sysmon/Operational | ||
RADIUS_NPS | Syslog RFC 3164 (QRadar) | \tRadiusLog\t | “Custom” Log type specified in policy. Set as "RadiusLog". | |
Windows MSSQL Via Syslog SNARE | Syslog RFC 3164 (QRadar) | MSSQL\$MICROSOFT##WID|MSSQLSERVER | Replace MSSQLSERVER with instance name | |
Windows MSSQL Via Syslog SNARE | Syslog RFC 3164 (QRadar) | MSSQL\$MICROSOFT##WID|MSSQLSERVER | Replace MSSQLSERVER with instance name |
...