@mohamed_el_mannouti (mohamed el mannouti) posted a new topic, subject "Qradar Logs to Logstash/Elastic?". It read:

   **we have a Qradar SIEM which we plan to extend to Elastic for threat hunting(Log Forwarding from Qradar to Elastic)**
    
    Has anyone found any success with it. Any known shortcomings/pitfalls from the setup.

So @leandrojmp (Leandro Pereira) replied

    QRadar can forward logs without any problem, you just need to choose how to forward it.
    
    I do not use QRadar anymore, but I would recommend that you forward already in json to logstash, it will give you less work if need or want to transform your data before sending to elasticsearch.

@mohamed_el_mannouti (mohamed el mannouti) replied

    thank you for your comment   
    Yes that do i want exactly but i don't know how i can do this.

@warkolm (Mark Walkom) replied

    Welcome to our community! 
    
    Please don't add unrelated tags to your topics in future

@system (system) replied

    This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.


{'source': 'discourse', 'url': 'https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385', 'title': 'Qradar Logs to Logstash/Elastic?', 'views': 386, 'has_accepted_answer': False, 'word_count': 142, 'like_count': 2, 'reply_count': 1, 'participant_count': 3, 'posts': 5, 'tags': '', 'author': '@mohamed_el_mannouti (mohamed el mannouti)', 'participants': '@mohamed_el_mannouti (mohamed el mannouti), @leandrojmp (Leandro Pereira), @warkolm (Mark Walkom), @system (system)', 'image_url': [None], 'created_at': '2021-05-29T00:44:06.133Z', 'last_posted_at': '2021-06-27T00:58:04.102Z'}