IBM QRadar

SIEM Platform

Synopsis

The IBM QRadar target forwards events, formatted as LEEF, to an IBM QRadar Event Collector over syslog. It handles transport framing (UDP, TCP, or TLS) — the event payload is expected to already be in LEEF format when it reaches the target.

Schema

- name: <string>
  description: <string>
  type: qradar
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    protocol: <string>
    hostname: <string>
    priority: <numeric>
    template: <string>
    max_message_size: <numeric>
    application_name: <string>
    tls:
      status: <boolean>
      verify: <boolean>
      server_name: <string>
      ca_name: <string>
      cert_name: <string>
      key_name: <string>
      passphrase: <string>
      min_tls_version: <string>
      max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following fields are used to define the target:

Field	Required	Default	Description
`name`	Y		Target name
`description`	N	-	Optional description
`type`	Y		Must be `qradar`
`pipelines`	N	-	Optional post-processor pipelines
`status`	N	`true`	Enable/disable the target

Connection

Field	Required	Default	Description
`address`	Y	-	QRadar Event Collector IP or hostname. Resolved at dial time
`port`	N	`514`	Remote receiver port. `514` for tcp/udp, often `6514` for tls. Valid range 1–65535
`protocol`	N	`tcp`	Transport protocol: `tcp`, `udp`, or `tls`

Framing

Field	Required	Default	Description
`hostname`	N	this host's name	Hostname written into the syslog header
`priority`	N	`13`	Syslog PRI value (facility×8 + severity). Valid range 0–191; `13` = user.notice
`template`	N	`<{{.Priority}}>{{.BSDTimestamp}} {{.Hostname}} {{.Message}}`	BSD (RFC 3164) syslog header template. Set to `{{.Message}}` to send the raw payload with no header
`max_message_size`	N	`0`	Maximum framed line length in bytes. `0` sends the full event
`application_name`	N	product name	Syslog tag / app-name. Only rendered when `template` references `{{.AppName}}` — the default template does not use it

TLS

Field	Required	Default	Description
`tls.status`	N	`false`	Enable TLS. Also enabled automatically when `protocol: tls`
`tls.verify`	N	`true`	Verify the server certificate
`tls.server_name`	N	-	SNI / expected server hostname
`tls.ca_name`	N	-	Custom CA to trust. Empty uses the OS trust store
`tls.cert_name`	N*	-	Client certificate for mutual TLS
`tls.key_name`	N*	-	Client key for mutual TLS
`tls.passphrase`	N	-	Passphrase for an encrypted client key
`tls.min_tls_version`	N	`tls1.2`	Minimum negotiated TLS version
`tls.max_tls_version`	N	`tls1.3`	Maximum negotiated TLS version

* = Conditionally optional. tls.cert_name and tls.key_name must be supplied together to enable mutual TLS; supplying only one fails configuration validation.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
Inline PEM content — used verbatim when the value contains -----BEGIN.
Environment variable — ${ENV_VAR}.
Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Processing

Field	Required	Default	Description
`field_format`	N	-	Optional target-side normalization format applied before delivery. Typically left empty, since the payload already arrives in LEEF from upstream processing. See applicable Normalization section

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
`debug.status`	N	`false`	Enable debug logging
`debug.dont_send_logs`	N	`false`	Process logs but don't send to target (testing)

Details

This target is transport-only: it does not render LEEF itself. It expects each event to already be a complete LEEF record when it reaches the target, and applies syslog framing and delivery on top of that payload. There is no batching — each event is a single, complete delivery to the QRadar Event Collector.

It is deliberately close to the generic syslog target but corrects two behaviors that matter for QRadar: there is no RFC-driven truncation (a generic syslog target forces a hard 2048-byte cut, and several LEEF events exceed that; here max_message_size, default 0, is the only cap and defaults to unlimited), and stream framing guarantees exactly one trailing newline per event so QRadar can separate consecutive events on a TCP or TLS connection.

Template Variables

The following variables are available in template:

Variable	Description
`{{.Year}}`	Current year (4-digit)
`{{.Month}}`	Current month (2-digit)
`{{.Day}}`	Current day (2-digit)
`{{.Priority}}`	Syslog PRI value
`{{.Timestamp}}`	Current time, RFC3339
`{{.BSDTimestamp}}`	Current time, RFC3164 (`Jan _2 15:04:05`)
`{{.Hostname}}`	Syslog-header hostname
`{{.AppName}}`	Application name (`application_name`)
`{{.PID}}`	Process ID
`{{.Message}}`	The LEEF payload

If template fails to render, the target falls back to sending the raw, sanitized payload with no header.

Framing and Transport

Embedded carriage returns and line feeds in the payload are neutralized before framing, so one event cannot forge a second line on the wire. On a TCP or TLS stream, exactly one trailing newline delimits each event (RFC 6587 non-transparent framing); this is harmless on UDP. No size limit applies by default (max_message_size: 0); set a cap when the transport is UDP and the receiver enforces a lower datagram limit.

TLS

TLS is enabled automatically when protocol: tls, or explicitly via tls.status: true. A client certificate is optional — supplying tls.cert_name without tls.key_name (or vice versa) fails configuration validation. tls.verify defaults to true.

note

The target does not perform LEEF rendering or field mapping — it only frames and delivers the payload it receives. Format the event as LEEF before it reaches this target.

Examples

Basic Configuration

Sending LEEF events to a QRadar Event Collector over TCP...

targets:
  - name: qradar
    type: qradar
    properties:
      address: "10.0.0.60"

Secure TLS

Delivering over an encrypted TLS connection with server verification...

targets:
  - name: qradar-tls
    type: qradar
    properties:
      address: "qradar.example.com"
      port: 6514
      protocol: tls
      tls:
        status: true
        verify: true

Raw LEEF Payload

Sending the LEEF payload with no syslog header, for a receiver that keys the log source another way...

targets:
  - name: qradar-raw
    type: qradar
    properties:
      address: "10.0.0.60"
      template: "{{.Message}}"

Synopsis​

Schema​

Configuration​

Connection​

Framing​

TLS​

Processing​

Scheduling​

Debug Options​

Details​

Template Variables​

Framing and Transport​