Question & Answer
Question
What email address are event export notifications sent?
Answer
When exporting events, you have the option to be notified when this process is completed. Depending on the size of the search being exported this process can take some time. Below are instructions to generated the event exports with the notification option:
The email notification is sent to the email address of the logged-in user account exporting the events.
Note: To check the email address of the logged-in User account, select the drop-down arrow of the user name at the top-right of the QRadar Console GUI. Then, select User Preference, here you will see the email address that is configured for the user account.
- Log in to QRadar Console GUI.
- Go to the Log Activity tab.
- Optional. If you are viewing events in streaming mode, click the Pause icon to pause streaming.
- Generate the needed search for export.
- Select Action > Export to CSV or Export to XML > Full Export(All Columns).
- When the Waiting for export to commence pop-up window appears, select the Notify When Done.
- This is confirmed with a pop-up window. You will be notified by email when the export is complete.
The email notification is sent to the email address of the logged-in user account exporting the events.
Note: To check the email address of the logged-in User account, select the drop-down arrow of the user name at the top-right of the QRadar Console GUI. Then, select User Preference, here you will see the email address that is configured for the user account.
[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Component":"Events","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
05 June 2024
UID
swg21990314