%3CLINGO-SUB%20id%3D%22lingo-sub-1488333%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20Side-by-Side%20with%20QRadar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1488333%22%20slang%3D%22en-US%22%3E%3CP%3ESpecial%20thanks%20to%20%E2%80%9C%3CEM%3EOfer%20Shezaf%3C%2FEM%3E%E2%80%9D%2C%20%E2%80%9C%3CEM%3EYaniv%20Shasha%3C%2FEM%3E%E2%80%9D%26nbsp%3Band%26nbsp%3B%E2%80%9C%3CEM%3EBindiya%20Priyadarshini%3C%2FEM%3E%E2%80%9D%26nbsp%3Bthat%20%3CSPAN%3Ecollaborating%20with%20me%20on%20this%20blog%20post%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20highlighted%20in%20my%20last%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-blog%20post%3C%2FSPAN%3E%20about%20Azure%20Sentinel%E2%80%99s%20Side-by-Side%20approach%20with%20Splunk%2C%20there%20are%20in%20fact%20reasons%20that%20enterprises%20are%20using%20Side-by-Side%20architecture%20to%20take%20advantage%20of%20Azure%20Sentinel.%20Side-by-Side%20is%20not%20only%20about%20having%20both%20SIEMs%20operating%20at%20the%20same%20time%2C%20but%20it%20also%20provides%20flexibility%20for%20migration%20of%20existing%20SIEM%20and%20SOAR%20use%20cases%20to%20Azure%20Sentinel.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20blog%20describes%20how%20Azure%20Sentinel%20can%20be%20used%20Side-by-Side%20with%20QRadar.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20following%20options%20are%20available%20to%20ingest%20Azure%20Sentinel%20alerts%20into%20QRadar%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EUsing%20the%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Microsoft%20Graph%20Security%20API%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3EUsing%20a%20Logic%20App%20flow%20that%20streams%20the%20alerts%26nbsp%3Bto%20%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fth-th%2Fazure%2Fconnectors%2Fconnectors-create-api-azure-event-hubs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EEvent%20Hub%3C%2FA%3E%3C%2FSPAN%3E.%26nbsp%3BYou%20can%20read%20about%20using%20Logic%20Apps%20%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fsending-alerts-enriched-with-supporting-events-from-azure%2Fba-p%2F1456976%22%20target%3D%22_blank%22%3Ehere%3C%2FA%3E%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3E.%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EThis%20blog%20post%20is%20going%20to%20cover%20the%20integration%20with%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Microsoft%20Graph%20Security%20API%3C%2FSPAN%3E%3CSPAN%3E.%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EQRadar%20can%20collect%20events%20from%20data%20sources%20by%20using%20a%20plug-in%20called%20Device%20Support%20Module%20(DSM).%20IBM%20provides%20a%20DSM%20to%20collect%20data%20from%20the%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Microsoft%20Graph%20Security%20API%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%E2%80%99s%20start%20the%20configuration!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EPreparation%20%26amp%3B%20Use%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EThe%20following%20tasks%20describe%20the%20necessary%20preparation%20and%20configurations%20steps.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EOnboarding%20Azure%20Sentinel%3C%2FLI%3E%0A%3CLI%3ERegistration%20of%20an%20application%20in%20Azure%20AD%3C%2FLI%3E%0A%3CLI%3EPreparation%20steps%20in%20QRadar%3C%2FLI%3E%0A%3CLI%3EConfiguration%20steps%20in%20QRadar%3C%2FLI%3E%0A%3CLI%3EUsing%20Azure%20Sentinel%20alerts%20in%20QRadar%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EOnboarding%20Azure%20Sentinel%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EOnboarding%20Azure%20Sentinel%20is%20not%20part%20of%20this%20blog%20post%3B%20however%2C%20required%20guidance%20can%20be%20found%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-here%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ERegistering%20an%20Application%20in%20Azure%20AD%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EThe%20steps%20required%20to%20register%20an%20app%20in%20Azure%20are%20described%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-here%3C%2FSPAN%3E.%20The%20registered%20app%20requires%20read%20access%20to%20the%20%3CEM%3ESecurityEvents.Read.All%20%3C%2FEM%3Efield%3CEM%3E%20in%20%3C%2FEM%3EMicrosoft%20Graph%20Security%20API.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20further%20configuration%20in%20QRadar%2C%20make%20a%20note%20of%20following%20settings%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EThe%20Azure%20AD%20Application%20ID%3C%2FLI%3E%0A%3CLI%3EThe%20Azure%20AD%20Application%20Secret%3C%2FLI%3E%0A%3CLI%3EThe%20Tenant%20ID%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EPreparation%20Steps%20in%20QRadar%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EUsing%20the%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-Microsoft%20Graph%20Security%20API%20DSM%3C%2FSPAN%3E%20to%20collect%20alerts%20from%20Azure%20Sentinel%20requires%20the%20following%20RPMs%20to%20be%20installed%20on%20QRadar%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EProtocol%20Common%20RPM%3C%2FLI%3E%0A%3CLI%3EMicrosoft%20Graph%20Security%20API%20Protocol%20RPM%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDownload%20the%20latest%20version%20of%20RPMs%20from%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-%3CA%20href%3D%22http%3A%2F%2Fwww.ibm.com%2Fsupport%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fwww.ibm.com%2Fsupport%3C%2FA%3E%3C%2FSPAN%3E%20and%20run%20the%20following%20commands%20to%20install%20the%20RPMs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CEM%3Eyum%20-y%20install%20DSM-DSMCommon-7.3-20190708191548.noarch.rpm%3C%2FEM%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CEM%3Eyum%20-y%20install%20PROTOCOL-MicrosoftGraphSecurityAPI-7.3-20200501003005.noarch.rpm%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EPreparation%20Steps%20in%20QRadar%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3ENow%20it%20is%20time%20to%20use%20the%20%3CSTRONG%3EQRadar%20portal%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3ELog%20on%20to%20the%20%E2%80%9C%3CSTRONG%3EQRadar%20portal%3C%2FSTRONG%3E%E2%80%9Cand%20click%20on%20%E2%80%9C%3CSTRONG%3EAdmin%3C%2FSTRONG%3E%E2%80%9Ctab%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorAlp%20Babayigit_0%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EOpen%20the%20%E2%80%9C%3CSTRONG%3EQRadar%20Log%20Source%20Management%3C%2FSTRONG%3E%E2%80%9C%20screen%20and%20click%20on%20the%20%E2%80%9C%3CSTRONG%3E%2BNew%20Log%20Source%3C%2FSTRONG%3E%E2%80%9D%20button%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture2.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200958iA0B90379D4E1F16B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture2.png%22%20alt%3D%22Picture2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3ESelect%20%E2%80%9C%3CSTRONG%3ESingle%20Log%20Source%3C%2FSTRONG%3E%E2%80%9D%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture3.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200959i7935A68B0F5902D9%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture3.png%22%20alt%3D%22Picture3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3ESearch%20for%20%22%3CSTRONG%3EUniversal%20DSM%3C%2FSTRONG%3E%22%3CSTRONG%3E%2C%20%3C%2FSTRONG%3Eselect%20it%20and%20click%20on%20%E2%80%9C%3CSTRONG%3EStep%202%3A%20Select%20Protocol%20Type%3C%2FSTRONG%3E%E2%80%9D%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture4.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200960iBE6BA05FC1599F36%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture4.png%22%20alt%3D%22Picture4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3ESearch%20for%20%22%3CSTRONG%3EMicrosoft%20Graph%20Security%20API%3C%2FSTRONG%3E%22%3CSTRONG%3E%2C%20%3C%2FSTRONG%3Eselect%20it%20and%20click%20on%20%22%3CSTRONG%3EStep%203%3A%20Configure%20Log%20Source%20Parameters%3C%2FSTRONG%3E%E2%80%9D%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture5.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200961i2962E749CA9F9643%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture5.png%22%20alt%3D%22Picture5.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EType%20a%20%22%3CSTRONG%3EName%22%3C%2FSTRONG%3E%20and%20a%20%22%3CSTRONG%3EDescription%3C%2FSTRONG%3E%22%2C%20and%20configure%20%22%3CSTRONG%3Eother%20parameters%3C%2FSTRONG%3E%22%20%2C%20and%20click%20to%20%22%3CSTRONG%3EStep%204%3A%20Configure%20Protocol%20Parameters%3C%2FSTRONG%3E%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture6.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200962iB685F33E821EF649%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture6.png%22%20alt%3D%22Picture6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EAdd%20a%20%22%3CSTRONG%3ELog%20Source%20Identifier%3C%2FSTRONG%3E%22%20and%20specify%20the%20parameters%20noted%20above%20when%20registering%20the%20Azure%20AD%20app%26nbsp%3B(%3CSTRONG%3EAzure%20AD%20Client%20ID%2C%20Azure%20AD%20Client%20Secret%20and%20Tenant%20ID%3C%2FSTRONG%3E).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EIf%20you%20want%20to%20filter%20only%20Azure%20Sentinel%20alerts%20from%20Microsoft%20Graph%20Security%20API%2C%20use%20the%20following%20filter%20in%20the%20parameter%20%22%3CSTRONG%3EEvent%20Filter%3C%2FSTRONG%3E%22.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-60px%22%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3CSTRONG%3Eprovider%20eq%20'Azure%20Sentinel'%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture7.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200964iDA005C418B6392B0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture7.png%22%20alt%3D%22Picture7.png%22%20%2F%3E%3C%2FSPAN%3E%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EClick%20on%20%E2%80%9C%3CSTRONG%3EStep%205%3A%20Test%20Protocol%20Parameters%3C%2FSTRONG%3E%E2%80%9D%20to%20continue%20with%20the%20wizard.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture8.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200966iCCAF87EFF62E6E1F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture8.png%22%20alt%3D%22Picture8.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EIf%20you%20want%20to%20validate%20the%20configuration%2C%20click%20%E2%80%9D%3CSTRONG%3EStart%20Test%3C%2FSTRONG%3E%E2%80%9D%2C%20otherwise%20finish%20the%20configuration%20by%20clicking%20%E2%80%9C%3CSTRONG%3ESkip%20Test%20and%20Finish%3C%2FSTRONG%3E%E2%80%9D.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture9.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200967iC3493D81A9771EE7%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture9.png%22%20alt%3D%22Picture9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EOnce%20the%20wizard%20is%20closed%2C%20the%20created%20%22%3CSTRONG%3ELog%20Source%3C%2FSTRONG%3E%22%20is%20shown%20on%20the%20%22%3CSTRONG%3ELog%20Source%20Management%3C%2FSTRONG%3E%22%20screen.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture10.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200968iE13612478D51F6BB%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture10.png%22%20alt%3D%22Picture10.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EHowever%2C%20the%20configuration%20is%20not%20finished%20yet%2C%20it%20must%20be%20deployed%20in%20the%20%22%3CSTRONG%3EQRadar%20Admin%20portal%3C%2FSTRONG%3E%22.%20Click%20on%20%22%3CSTRONG%3EDeploy%20Change%3C%2FSTRONG%3E%22%20to%20apply%20the%20configuration.%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Picture11.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F200969iA46AC74568DA8078%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22Picture11.png%22%20alt%3D%22Picture11.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EUsing%20of%20Azure%20Sentinel%20alerts%20in%20QRadar%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EOnce%20the%20alerts%20are%20ingested%2C%20you%20can%20query%20Azure%20Sentinel%20alerts%20in%20QRadar.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EA%20sample%20RAW%20alert%20from%20Azure%20Sentinel%20collected%20from%20Microsoft%20Security%20Graph%20API%20looks%20as%20shown%20below.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7B%22%3CSPAN%3E%3CSTRONG%3EeventDateTime%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3E2020-06-08T10%3A39%3A58.3572933Z%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3Ecategory%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%3CSPAN%3E_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3EazureSubscriptionId%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Edescription%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3EIdentifies%3C%2FSPAN%3E%20%3CSPAN%3Ewhen%3C%2FSPAN%3E%20%3CSPAN%3Ean%3C%2FSPAN%3E%20%3CSPAN%3ERDP%3C%2FSPAN%3E%20%3CSPAN%3Econnection%3C%2FSPAN%3E%20%3CSPAN%3Eis%3C%2FSPAN%3E%20%3CSPAN%3Enew%3C%2FSPAN%3E%20%3CSPAN%3Eor%3C%2FSPAN%3E%20%3CSPAN%3Erare%3C%2FSPAN%3E%20%3CSPAN%3Erelated%3C%2FSPAN%3E%20%3CSPAN%3Eto%3C%2FSPAN%3E%20%3CSPAN%3Eany%3C%2FSPAN%3E%20%3CSPAN%3Elogon%3C%2FSPAN%3E%20%3CSPAN%3Etype%3C%2FSPAN%3E%20%3CSPAN%3Eby%3C%2FSPAN%3E%20%3CSPAN%3Ea%3C%2FSPAN%3E%20%3CSPAN%3Egiven%3C%2FSPAN%3E%20%3CSPAN%3Eaccount%3C%2FSPAN%3E%20%3CSPAN%3Etoday%3C%2FSPAN%3E%20%3CSPAN%3Ebased%3C%2FSPAN%3E%20%3CSPAN%3Eon%3C%2FSPAN%3E%20%3CSPAN%3Ecomparison%3C%2FSPAN%3E%20%3CSPAN%3Ewith%3C%2FSPAN%3E%20%3CSPAN%3Ethe%3C%2FSPAN%3E%20%3CSPAN%3Eprevious%3C%2FSPAN%3E%20%3CSPAN%3E14%3C%2FSPAN%3E%20%3CSPAN%3Edays.%5CnRDP%3C%2FSPAN%3E%20%3CSPAN%3Econnections%3C%2FSPAN%3E%20%3CSPAN%3Eare%3C%2FSPAN%3E%20%3CSPAN%3Eindicated%3C%2FSPAN%3E%20%3CSPAN%3Eby%3C%2FSPAN%3E%20%3CSPAN%3Ethe%3C%2FSPAN%3E%20%3CSPAN%3EEventID%3C%2FSPAN%3E%20%3CSPAN%3E4624%3C%2FSPAN%3E%20%3CSPAN%3Ewith%3C%2FSPAN%3E%20%3CSPAN%3ELogonType%3C%2FSPAN%3E%20%3CSPAN%3E%3D%3C%2FSPAN%3E%20%3CSPAN%3E10%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Estatus%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3EnewAlert%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Eseverity%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3Emedium%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Etitle%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3ERare%3C%2FSPAN%3E%20%3CSPAN%3ERDP%3C%2FSPAN%3E%20%3CSPAN%3EConnections%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3EhostStates%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%5B%7B%22%3CSPAN%3E%3CSTRONG%3EnetBiosName%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3ECLIENT%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Efqdn%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3ECLIENT.DOMAIN.LOCAL%3C%2FSPAN%3E%22%7D%5D%2C%20%22%3CSPAN%3EvendorInformation%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%7B%22%3CSPAN%3E%3CSTRONG%3Evendor%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3EMicrosoft%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3Eprovider%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3EAzure%3C%2FSPAN%3E%20%3CSPAN%3ESentinel%3C%2FSPAN%3E%22%7D%2C%20%22%3CSPAN%3E%3CSTRONG%3EcreatedDateTime%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3E2020-06-22T10%3A45%3A00.0929766Z%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3ElastModifiedDateTime%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3E2020-06-22T10%3A45%3A00.1940637Z%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3EuserStates%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%5B%7B%22%3CSPAN%3E%3CSTRONG%3EuserPrincipalName%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3Euser%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3EemailRole%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3Eunknown%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3EaccountName%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3Eaccount%3C%2FSPAN%3E%22%2C%20%22%3CSPAN%3E%3CSTRONG%3EdomainName%3C%2FSTRONG%3E%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22%3CSPAN%3Edomain%3C%2FSPAN%3E%22%7D%5D%2C%20%22%3CSPAN%3Eid%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%22%2C%20%22%3CSPAN%3EazureTenantId%3C%2FSPAN%3E%22%3CSPAN%3E%3A%3C%2FSPAN%3E%20%22xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx%22%7D%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESummary%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EWe%20just%20walked%20through%20the%20process%20of%20standing%20up%20Azure%20Sentinel%20Side-by-Side%20with%20QRadar.%20Stay%20tuned%20for%20more%20Side-by-Side%20scenarios%20in%20our%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-blog%20channel%3C%2FSPAN%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1488333%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20highlighted%20in%20my%20last%20%3CSPAN%3E-ERR%3AREF-NOT-FOUND-blog%20post%3C%2FSPAN%3E%20about%20Azure%20Sentinel%E2%80%99s%20Side-by-Side%20approach%20with%20Splunk%2C%20there%20are%20in%20fact%20reasons%20that%20enterprises%20are%20using%20Side-by-Side%20architecture%20to%20take%20advantage%20of%20Azure%20Sentinel.%20Side-by-Side%20is%20not%20only%20about%20having%20both%20SIEMs%20operating%20at%20the%20same%20time%2C%20but%20it%20also%20provides%20flexibility%20for%20migration%20of%20existing%20SIEM%20and%20SOAR%20use%20cases%20to%20Azure%20Sentinel.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20blog%20describes%20how%20Azure%20Sentinel%20can%20be%20used%20Side-by-Side%20with%20QRadar.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1488333%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Sentinel%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1710392%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20Side-by-Side%20with%20QRadar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1710392%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20about%20the%20other%20way%20round%2C%20which%20would%20in%20the%20current%20cloud%20world%20and%20also%20from%20Microsoft%20perspective%20be%20even%20more%20interesting%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20there%20is%20for%20historical%20reasons%20a%20Qradar%20system%20collecting%20logs%20from%20various%20parts%20of%20the%20infrastructure%2C%20how%20would%20we%20get%20this%20information%20in%20usable%20form%20into%20Azure%20Sentinel%3F%20At%20least%20for%20our%20use%20case%20Sentinel%20is%20more%20sophisticated%20and%20modern%20system%20which%20is%20at%20the%20same%20time%20connected%20to%20so%20many%20more%20sources%20(and%20volumes)%20in%20the%20cloud%20world%20that%20can't%20be%20reasonably%20imported%20into%20Qradar.%20Qradar%20is%20not%20bad%2C%20but%20the%20Sentinel%20approach%20as%20whole%20would%20bring%20us%20more%20benefit.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1737395%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20Side-by-Side%20with%20QRadar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1737395%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20tutorial%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239761%22%20target%3D%22_blank%22%3E%40Alp%20Babayigit%3C%2FA%3E%2C%26nbsp%3Bthanks%20for%20your%20knowledge...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20followed%20all%20the%20steps%2C%20I%20have%20to%20need%20to%20recognize%20that%20I'm%20not%20an%20QRadar%20expert%2C%20but%20finally%20I%20get%20two%20installations%20of%20QRadar%20(one%20on%20a%20VM%20over%20Virtual%20Box%2C%20that%20I%20was%20deployed%20ussing%20the%20%3CSTRONG%3EOva%3C%2FSTRONG%3E%20of%20the%20%3CSTRONG%3EQRadar%20Community%20Edition%3C%2FSTRONG%3E%2C%20and%20the%20other%20over%20Azure%2C%26nbsp%3B%3CSTRONG%3EIBM%20QRadar%20SIEM%20v7.3.3%20(BYOL)%3C%2FSTRONG%3E%26nbsp%3Bjust%20the%20console).%20And%20in%20both%20scenarios%20I%20get%20the%20same%20error%20at%20the%20time%20of%20running%20the%20test%20of%20the%20%22New%20Log%20Source%22%2C%20the%20error%20is%3A%26nbsp%3B%3CSTRONG%3ETest%20failed%20to%20start%20in%20a%20timely%20manner.%20Please%20try%20again%20or%20contact%20support%3C%2FSTRONG%3E.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESomeone%20could%20help%20me%20to%20remediate%20this%20issue%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20in%20advance%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1739844%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20Side-by-Side%20with%20QRadar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1739844%22%20slang%3D%22en-US%22%3E%3CP%3EAgree%20with%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F251388%22%20target%3D%22_blank%22%3E%40hstrang%3C%2FA%3E%26nbsp%3B%2C%20what%20about%20feeding%20Sentinel%20with%20QRadar%20information%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1881631%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20Side-by-Side%20with%20QRadar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1881631%22%20slang%3D%22en-US%22%3E%3CP%3EAs%20previously%20mentioned%2C%20the%20ideal%20would%20be%20to%20transition%20away%20from%20QRadar%2C%20so%20simple%20forwarding%20from%20QRadar%20Event%20Processor%20to%20Sentinel%20would%20be%20of%20great%20use.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Special thanks to “Ofer Shezaf”, “Yaniv Shasha” and “Bindiya Priyadarshini” that collaborating with me on this blog post

 

As highlighted in my last blog post about Azure Sentinel’s Side-by-Side approach with Splunk, there are in fact reasons that enterprises are using Side-by-Side architecture to take advantage of Azure Sentinel. Side-by-Side is not only about having both SIEMs operating at the same time, but it also provides flexibility for migration of existing SIEM and SOAR use cases to Azure Sentinel.

 

This blog describes how Azure Sentinel can be used Side-by-Side with QRadar.

 

The following options are available to ingest Azure Sentinel alerts into QRadar:

This blog post is going to cover the integration with Microsoft Graph Security API. 

 

QRadar can collect events from data sources by using a plug-in called Device Support Module (DSM). IBM provides a DSM to collect data from the Microsoft Graph Security API.

 

Let’s start the configuration!

 

Preparation & Use

The following tasks describe the necessary preparation and configurations steps.

  • Onboarding Azure Sentinel
  • Registration of an application in Azure AD
  • Preparation steps in QRadar
  • Configuration steps in QRadar
  • Using Azure Sentinel alerts in QRadar

 

Onboarding Azure Sentinel

Onboarding Azure Sentinel is not part of this blog post; however, required guidance can be found here.

 

Registering an Application in Azure AD

The steps required to register an app in Azure are described here. The registered app requires read access to the SecurityEvents.Read.All field in Microsoft Graph Security API.

 

For further configuration in QRadar, make a note of following settings:

  • The Azure AD Application ID
  • The Azure AD Application Secret
  • The Tenant ID

Preparation Steps in QRadar

Using the Microsoft Graph Security API DSM to collect alerts from Azure Sentinel requires the following RPMs to be installed on QRadar:

 

  • Protocol Common RPM
  • Microsoft Graph Security API Protocol RPM

 

Download the latest version of RPMs from http://www.ibm.com/support and run the following commands to install the RPMs.

 

yum -y install DSM-DSMCommon-7.3-20190708191548.noarch.rpm

yum -y install PROTOCOL-MicrosoftGraphSecurityAPI-7.3-20200501003005.noarch.rpm

 

Preparation Steps in QRadar

Now it is time to use the QRadar portal.

 

Log on to the “QRadar portal“and click on “Admin“tab

 

Open the “QRadar Log Source Management“ screen and click on the “+New Log Source” button

 Picture2.png

 

Select “Single Log Source

Picture3.png

 

Search for "Universal DSM", select it and click on “Step 2: Select Protocol Type

Picture4.png

 

Search for "Microsoft Graph Security API", select it and click on "Step 3: Configure Log Source Parameters

 Picture5.png

 

Type a "Name" and a "Description", and configure "other parameters" , and click to "Step 4: Configure Protocol Parameters"

 

Picture6.png

 

Add a "Log Source Identifier" and specify the parameters noted above when registering the Azure AD app (Azure AD Client ID, Azure AD Client Secret and Tenant ID).

 

If you want to filter only Azure Sentinel alerts from Microsoft Graph Security API, use the following filter in the parameter "Event Filter".

 

    provider eq 'Azure Sentinel'

 

Picture7.png                   

Click on “Step 5: Test Protocol Parameters” to continue with the wizard.

Picture8.png

 

If you want to validate the configuration, click ”Start Test”, otherwise finish the configuration by clicking “Skip Test and Finish”.

Picture9.png

 

Once the wizard is closed, the created "Log Source" is shown on the "Log Source Management" screen.

Picture10.png

 

However, the configuration is not finished yet, it must be deployed in the "QRadar Admin portal". Click on "Deploy Change" to apply the configuration.

Picture11.png

 

Using of Azure Sentinel alerts in QRadar

Once the alerts are ingested, you can query Azure Sentinel alerts in QRadar.

 

A sample RAW alert from Azure Sentinel collected from Microsoft Security Graph API looks as shown below.

 

{"eventDateTime": "2020-06-08T10:39:58.3572933Z", "category": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "azureSubscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "description": "Identifies when an RDP connection is new or rare related to any logon type by a given account today based on comparison with the previous 14 days.\nRDP connections are indicated by the EventID 4624 with LogonType = 10", "status": "newAlert", "severity": "medium", "title": "Rare RDP Connections", "hostStates": [{"netBiosName": "CLIENT", "fqdn": "CLIENT.DOMAIN.LOCAL"}], "vendorInformation": {"vendor": "Microsoft", "provider": "Azure Sentinel"}, "createdDateTime": "2020-06-22T10:45:00.0929766Z", "lastModifiedDateTime": "2020-06-22T10:45:00.1940637Z", "userStates": [{"userPrincipalName": "user", "emailRole": "unknown", "accountName": "account", "domainName": "domain"}], "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "azureTenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}

 

Summary

We just walked through the process of standing up Azure Sentinel Side-by-Side with QRadar. Stay tuned for more Side-by-Side scenarios in our blog channel.

 

 

4 Comments
Occasional Visitor

How about the other way round, which would in the current cloud world and also from Microsoft perspective be even more interesting?

 

If there is for historical reasons a Qradar system collecting logs from various parts of the infrastructure, how would we get this information in usable form into Azure Sentinel? At least for our use case Sentinel is more sophisticated and modern system which is at the same time connected to so many more sources (and volumes) in the cloud world that can't be reasonably imported into Qradar. Qradar is not bad, but the Sentinel approach as whole would bring us more benefit.

 

Frequent Visitor

Great tutorial @Alp Babayigit, thanks for your knowledge...

 

I followed all the steps, I have to need to recognize that I'm not an QRadar expert, but finally I get two installations of QRadar (one on a VM over Virtual Box, that I was deployed ussing the Ova of the QRadar Community Edition, and the other over Azure, IBM QRadar SIEM v7.3.3 (BYOL) just the console). And in both scenarios I get the same error at the time of running the test of the "New Log Source", the error is: Test failed to start in a timely manner. Please try again or contact support.

 

Someone could help me to remediate this issue?

 

Thanks in advance

New Contributor

Agree with @hstrang , what about feeding Sentinel with QRadar information?

Senior Member

As previously mentioned, the ideal would be to transition away from QRadar, so simple forwarding from QRadar Event Processor to Sentinel would be of great use.