Configuring the log source
SNS firewalls send their logs to IBM QRadar over the syslog protocol.
- Log in to your IBM QRadar console.
- In the Admin menu, select Log Source.
- Click on Add.
- Fill in the form to create the Log Source:
- Log Source Name field: enter a name for your new log source (e.g.: Stormshield SNS device).
- Log Source description field: enter a description of your new log source.
- Protocol Configuration field: select Syslog.
- Log Source Identifier field: enter the host name of your SNS firewall.
If no host name has been defined on your firewall, enter its serial number (e.g.: VMSNSX0000000A1).
- Log Source Extension field: selectStormshieldNeworkSecurityCustom_ext.
- Click on Save.