Start by importing the powershell modules:
import-module "C:\Program Files\Quest\ChangeAuditor\Client\changeauditor.powershell.dll"
Note: you may need to use a different file path, based on where you have the client software installed.
Next you need to set some variables to use:
$QRadarHost = '10.100.42.20'
Note: you can use the IP or the FQDN of the QRadar appliance.
Let us setup a connection variable to use:
$connection = Connect-CAClient -InstallationName 'MyInsallationName' -DomainName 'mydomain.tld'
Note: Substitute your actual ChangeAuditor installation name instead of using Myinstallation name
Note: The DomainName switch is optional most of the time.
Finally, we can invoke the powershell command to create the QRadar event subscription:
New-CAQRadarEventSubscription -Connection $connection -QRadarHost $QRadarHost
Note: This should start a quick wizard with a few questions that will create and deploy your event subscription.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center