Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Editing a Log Source

Use the QRadar Log Source Management app to configure log sources to receive event logs.

  1. In the QRadar Log Source Management app, select a log source.

  2. On the Log Source Summary pane, click Edit.

  3. Configure the parameters and click Save.

    For more information about how to configure a specific protocol, see Configuring DSM’s Guide.

To view the log activity for a log source, select the log source and click Events.

Editing Multiple Log Sources At the Same Time

In the QRadar Log Source Management app, view and edit a number of log sources at the same time. Edit multiple log sources when the log sources have similar parameters that you want to change, instead of editing each log source individually.

  1. In the QRadar Log Source Management app, select the relevant log sources that you want to edit.

    1. To edit all of your log sources, select the Select All checkbox and click Select all log sources.

  2. Click Edit.

  3. In the Log Source Summary pane, select and edit the parameters and click Save.

    Note:

    You cannot edit the Log Source Identifier parameter in bulk.

  4. In the Name Template and Description Template fields, use the available variables to create the names and descriptions of the selected log sources.

  5. Click the Protocol tab to edit the protocol parameters for the selected log sources. The selected log sources must share a protocol.

  6. Click Save.

Related Documentation