Qradar SIEM integration

フォローする

新規投稿

rrosales

• 2017年03月22日 13:41

I am trying to connect Box RESTAPI to our IBM Qradar SIEM for compliance management. I have followed the documents and video's however non of them identify what to use as the Log Source Identifier.

 

All other instructions to get ClientID, Secret, KeyID, EntID, and PrivKey have all been completed and supplied into Qradar interface.

 

I have attempted to use all of the below with no success.

https://api.box.com/

http://api.box.com/

api.box.com/

https://api.box.com/oauth2/token

https://account.box.com/api/

 

Failed - ERROR - Unable to collect events. 

0

• 

  Ram404

  • 2017年05月11日 10:14

  Hi,

  Did you get this fixed ?

   

  0

  コメントアクション パーマリンク
• 

  rrosales

  • 2017年05月11日 10:22

  No. We are still struggling to get this active. It initially connects as a log source, but then errors out saying it cannot get any data.
  
  
  
  
  
  
  
  
  

  0

  コメントアクション パーマリンク
• 

  RetroJack

  • 2018年01月26日 07:08

  I realize this post is rather old at this point - but it got us going down the right path, and we eventually got it figure out.

   

  For event logs - your log source identifier URL needs to be:

  https://api.box.com/2.0/events

  After we set that, everything started flowing in with no issues.

  I found this in the API user guide for Box - specifically in the "User Events" section.

  0

  コメントアクション パーマリンク

サインインしてコメントを残してください。