Change Auditor | Managing an IBM QRadar integration (4381714)

n/a

n/a

You can take advantage of the rich data gathered by Change Auditor and use it with QRadar on-premises deployments. To begin sending event data, you need to create the QRadar extension and a QRadar event subscription with Change Auditor. The subscription contains information about where to send the notifications and heartbeats and the event subsystems to include.

IMPORTANT: To ensure that QRadar can read and present Change Auditor events, you need to import the extension created during the subscription creation or with the New-CAQRadarExtension command.

1. Open the QRadar console and select the Admin tab.
2. Select Extensions Management | Add.
3. Select the extension zip file and follow the instructions.
4. If prompted that the extension is not signed, select Install. When prompted to overwrite or keep existing data, select Overwrite.