IBM QRadar: How to Create a Rule for Log Source Monitoring

1. Go to the Rules Section:
   • Navigate to Offenses > Rules.
   • Click Actions > New Event Rule.

Then you will Rule Wizard window.
In this step, use the default parameter.

• In the rule editor, click on Test Group and choose from the drop-down list Log Source Test
• Search for and select parameter ‘when the event(s) have not been detected by’.
• Set the ‘of these log sources’ and ‘this many’(e.g., 10 minutes(set in seconds)).

For example, in the screenshot, I named rule test_wather then I set “and when the event(s) have not been detected by one or more of SRV-WIN-XXX for 6000 seconds” selected Group “System” and added Notes “log source monitoring“:

• Under the Response tab, choose the response(s) to make when an event triggers this rule.
  • Click Manage Destinations
  • In the open window click add: To add a new destination.
  • In the open window Forwarding Destination Properties: Set your destination properties and click Save. For example, in the screenshot, I set the destination on a server by using tcp protocol. 

After that, you can see your created Destination. Choose it and click finish

Now in Offenses, you can see your created rule. For example, in the screenshot, I created Rule test_wather.

Now if your log source stops coming, you will see a message about it. For example, in the screenshot, Rule send a message on the server by tcp protocol. 

The post IBM QRadar: How to Create a Rule for Log Source Monitoring appeared first on SOC Prime.

Related posts:

New Bumblebee Loader Infection Chain Signals Possible Resurgence IBM QRadar – When The Attacker Controls Your Security Stack (CVE-2022-26377) Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defenses Flowise Stored Cross-Site Scripting