2010 - 充分利用您的 SIEM：QRadar 数据采集、搜索和检测专家指南.pdf

1、Orlando,FLOctober 69IBM TechXchange 2025Session code 2010Colin Hay,Nick Antonov IBMFrank Eargle GlassHouse SystemsGetting the most from Getting the most from your SIEM:an expert your SIEM:an expert guide to data guide to data ingestion,search,and ingestion,search,and detection in QRadardetection in

2、QRadarAgenda0102030405OverviewData IngestionDetection and ResponseSearch and InvestigationQ&A(please hold till end)IBM TechXchange|2025 IBM CorporationData Ingestion:Event PipelineIBM TechXchange|2025 IBM Corporation3Data Ingestion:CluesWhat to ingestHow to“best practices”ingest TCP always over UDP

3、Use DictionaryAt LEAST get the events with security information!Check SIM Generic log source Search for unparsed eventsIBM TechXchange|2025 IBM Corporation41756212047262 10.1.1.1 LEEF:1.0|EMC|VMWare|1|UserLoginSessionEvent|usrName=vpxuser src=172.16.1.1 identSrc=127.0.0.1 devTime=1756212047262 msg=U

4、ser vpxuser127.0.0.1 logged in as VMware-client/8.0.3Aug 26 12:01:01 hostname CROND911033:(root)CMD(run-parts/etc/cron.hourly)Aug 27 10:12:07 hostname enterpriseAgent.pl6188:Use of uninitialized value in numeric ne(!=)at/home/install/sbin/enterpriseAgent.pl line 399,line 130.Aug 27 10:50:40 hostname

5、 systemd-journald521:Forwarding to syslog missed 7 messages.Aug 27 13:20:20 L-CMH-E3/14-2B60 kernel:*08/27/2025 12:50:20.4610 Aug 27 10:50:02 hostname dns-agent16741:Error:Using domain server:Name:10.2.2.2 Address:10.3.3.3#53 Aliases:Host somehost.somedomain not found:3(NXDOMAIN)IBM TechXchange|2025

6、 IBM Corporation51756212047262 172.20.10.23 LEEF:1.0|EMC|VMWare|1|UserLoginSessionEvent|usrName=vpxuser src=172.20.10.23 identSrc=127.0.0.1 devTime=1756212047262 msg=User vpxuser127.0.0.1 logged in as VMware-client/8.0.3 1756212047262 172.20.10.23 LEEF:1.0|EMC|VMWare|1|UserLoginSessionEvent|usrName=