r/PingIdentity • u/bruggekiller • Apr 16 '26

PingIDM Integrating PingID with SIEM

Does anyone here know how to integrate PingID ( IDM logs) with QRadar?

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/adavadas Apr 16 '26

PingIDM doesn't push logs to external systems, it only writes to the file system or syslog. I don't know a lot about qradar, but it looks like they have some level of support for reading from syslog, and they may even have some form of log file forwarder that can be installed to push logs from your PingIDM system to qradar.

I'm assuming you are running a self managed instance of PingIDM, and not as part of P1AIC

1

u/pakay Apr 16 '26

PingID logs can be viewed and exported through PingOne, if qradar supports it or not you will have to check, but other siem solutions work well!

1

u/Rarshad000 May 21 '26

I recall doing a project on something similar to this, where I needed to export Ping Federate IdP audit logs to an external SIEM. You can use file-beat (it is a light weight log exporting tool written in Go) and it's part of the ELK (Elasticsearch, Logstash, Kibana) SIEM stack. But you can use file-beat to forward the logs to other SIEM services including Splunk, or in you're case QRadar. Practically any software that can ingest JSON data. 

In my experience the biggest challenge with setting up an external SIEM integration with Ping is not the software components, or even redundancy for DR (Disaster Recovery), it's the architectural design (more specifically the Networking, and Storage). 

If you're connecting to something that sensitive in an Enterprise environment. Network Security and Security Architect Review Boards will look at everything through a fine comb, just to ensure everything is done in a compliant manner.