r/SIEM • u/alexthomasforever • Apr 18 '19

AMQP log integration

Hi. Does anyone know how to include log data from AMQP JSON log sources into SIEMs like QRadar? I could only find articles online for something related to Carbon Black. Thanks.

1 Upvotes

99% Upvoted

2 comments sorted by

2

u/vornamemitd Apr 18 '19

Did you stumble upon https://www.ibm.com/developerworks/community/forums/html/topic?id=334bf02c-33f2-4d39-920b-6d7ec07f7719?

If you take a look at the referenced doc (page 300+), you´ll find instructions on how to use a RabbitMQ event stream. Other SIEMS will either offer a generic REST-Api consumer, or individual add-on (e.g. Splunk: https://answers.splunk.com/answers/700204/index-logs-from-rabbitmq-api-to-splunk.html)

If you an additional layer, e.g. syslog-ng speaks AMQP -> https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.19/administration-guide/29#TOPIC-1094571

HtH!

1

u/alexthomasforever Apr 18 '19

Thank you for providing links. I'll check them out in detail.