I want the reporter member to send syslog to siem not all members ?

SHAdy
SHAdy
edited September 2 in DNS Detection & Response

l have Qradar siem and i see all members send its syslogs from LAN1 ip to Qradar so i want all members to send syslog to reporter member and then reporter send to me syslog of all members so i can add only ip of reporter in source list in Qradar

Answers

  • MattR
    MattR Infoblox Technical Expert
    edited November 21

    Each appliance will only send syslog directly. This prevents a single point of failure and a funnel point for all event information.

  • Don Smith
    Don Smith

    Your question and description reflect opposite actions. I'll assume your description is what you intend.

    You can have logs sent from the members to the reporting server and then filter the logs to send to your SIEM. In fact, depending on what type of information you are logging, it's a best practice to not send syslog directly from each member as that can have a significant impact on potential performance capabilities.

Categories