Enabling IBM QRadar and HP ArcSight syslog redirection - BlueCat Address Manager - 8.2.0

Address Manager provides support for IBM^® QRadar^® and HP^® ArcSight^® SIEM integration through DNS/DHCP Server syslog to provide more analysis of DNS and DHCP data within an organization.

1. From the configuration drop-down menu, select a configuration.
2. Select the Servers tab. Tabs remember the page you last worked on, so select the tab again to ensure you're on the Configuration information page.
3. Under Servers, click a server name. The Details tab for the server opens.
4. Click the server name menu and select Service Configuration. The Configure Remote Services page opens.
5. From the Service Type drop-down menu, select Syslog. Address Manager queries the server and returns the current values for the service settings.
6. Under SIEM Settings, set the following parameters:
   • Enable QRadar Forwarding—select the check box and enter the IPv4 or IPv6 address of the QRadar server.
   • Enable ArcSight Forwarding—select the check box and enter the IPv4 or IPv6 address of the ArcSight server.
7. Click Update.