Question & Answer
Question
How do you disable QRadar Network Security (XGS) event posting to SiteProtector?
Answer
Some users managing the XGS appliance in SiteProtector might not want events that are generated by the XGS to be forwarded to the SiteProtector Database. However, they still want the events to log to the web interface (LMI) Alerts Database. In this scenario, you can add the following tuning parameter to the Advanced Tuning Parameters policy:
Key:
Value:
With this parameter in place, SiteProtector is still used to manage policies and events are still logged locally on the XGS; the events are just not forwarded to the SiteProtector Database.
Key:
events.response.sp_post.enabledValue:
falseWith this parameter in place, SiteProtector is still used to manage policies and events are still logged locally on the XGS; the events are just not forwarded to the SiteProtector Database.
[{"Product":{"code":"SSFSVP","label":"IBM QRadar Network Security"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSETBF","label":"IBM Security SiteProtector System"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Database","Platform":[{"code":"PF033","label":"Windows"}],"Version":"3.0;3.1;3.1.1","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}},{"Product":{"code":"SSHLHV","label":"IBM Security Network Protection"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"General Information","Platform":[{"code":"PF009","label":"Firmware"}],"Version":"5.3.1;5.3.2;5.3.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
24 January 2021
UID
swg21963637