Qradar SIEM integration
I am trying to connect Box RESTAPI to our IBM Qradar SIEM for compliance management. I have followed the documents and video's however non of them identify what to use as the Log Source Identifier.
All other instructions to get ClientID, Secret, KeyID, EntID, and PrivKey have all been completed and supplied into Qradar interface.
I have attempted to use all of the below with no success.
https://api.box.com/oauth2/token
Failed - ERROR - Unable to collect events.
-
I realize this post is rather old at this point - but it got us going down the right path, and we eventually got it figure out.
For event logs - your log source identifier URL needs to be:
https://api.box.com/2.0/events
After we set that, everything started flowing in with no issues.
I found this in the API user guide for Box - specifically in the "User Events" section.
サインインしてコメントを残してください。
コメント
3件のコメント