QRadar Plugin for Log Shipper

QRadar Plugin for Log Shipper

This document explains how to configure your QRadar integration with the Log Shipper module of the Netskope Cloud Exchange platform. This integration allows pushing alerts and events from Netskope to the QRadar platform.


To complete this configuration, you need:

  • A Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
  • A Netskope Cloud Exchange tenant with the Log Shipper module already configured.
  • A QRadar instance.


Verify your QRadar instance permissions are secure and not set up for open public access. Only allow access to your cloud storage instance from your Cloud Exchange Host and any other addresses that need access.

QRadar Plugin Support
Event SupportYes
Alert SupportYes
WebTx SupportYes
Logs SupportYes

All Netskope events, alert logs, and web transaction logs will be shared.


  • Incident event type is supported from Core version 4.1.0.
  • CTEP alert type will be supported from Core version 4.2.0

CE version: v4.1.0 and v4.2.0.

API Details

The plugin uses a logging third-party library to push the data to the Syslog collector.

Refer to the official documentation for more information on the logging library.


Performance Matrix
Logs IngestedTime Taken
99400002 hours
Stack SizeLarge
Core: 16
Alerts/Events~ 6 MBps
WebTx~ 6 MBps


  1. Configure your QRadar Server, Port, and TLS Certificate information.
  2. Configure the QRadar Plugin.
  3. Configure Log Shipper Business Rules for QRadar.
  4. Configure Log Shipper SIEM Mappings for QRadar.
  5. Configure the WebTx Mappings (optional).
  6. Validate the QRadar plugin.

Click play to watch a video.


Configure your QRadar Server, Port, and TLS Certificate Information

To create a log source in QRadar (through a Log Source Management app) for ingesting data with TCP/UDP/TLS protocol from Netskope, perform following steps:

  1. Download and install the Netskope Security Cloud DSM from here
  2. Go to the Log Source Management App via the Admin Panel.
  3. When a separate window opens, click + New Log Source.
  4. Select Netskope for the Log Source type.
  5. For receiving data sent through TCP/UDP protocol from Log Shipper, select protocol type as Syslog; for receiving data sent through TLS select protocol type as TLS Syslog.


    The Default port for TCP/UDP (Syslog) in QRadar is 514, and for TLS Syslog is 6514.

    For more information, refer:- https://www.ibm.com/docs/en/qsip/7.4?topic=qradar-port-usage

  6. In the section under Configure Log Source parameters, enter the name of the log source, keep the log source enabled, and the Coalescing events checkbox disabled.
  7. In the section under Configure the protocol parameters, enter a Log Source Identifier, like netskopece.
    • Once you have successfully deployed a log source after that take the TLS certificate by running the command (cat /opt/qradar/conf/trusted_certificates/syslog-tls.cert) from the QRadar VM where the log source is deployed. This TLS certificate is required while configuring QRadar Plugin with TLS Protocol.
    • For the field Max Payload Length, we have observed that events are getting truncated even if we set the value to maximum, like 32768, in this field. To avoid truncation of payload, we recommend changing payload length by following the steps given here.
  8. Click Skip Test and then Finish. Next, deploy a log source.

Deploy Log Source

Click on Deploy as shown below.


Configure the QRadar Plugin

  1. In Cloud Exchange, go to Settings > Plugins.
  2. Search for and select the QRadar box to open the plugin creation pages.
  3. Enter a Configuration Name.
  4. Select a valid Mapping. (Default Mapping for all plugins are available.

    Transform the raw logs: If enabled, Raw logs will be transformed using selected mapping file, else raw logs will be sent to SIEM. The ingestion may be affected if the SIEM does not accept raw logs format.

  5. Click Next.
  6. Enter a QRadar Server, select a QRadar Format and QRadar Protocol, and then enter your QRadar Port and QRadar Certificate information.
  7. Enter the information for yourQRadar Server, select the QRadar Format and QRadar Protocol, and then enter QRadar Port and QRadar Certificate.
  8. Enter a Log Source Identifier. The Default value would be netskopece. The Log Source Identifier should not contain the whitespaces. This will be added as a prefix to all logs.
  9. Click Save.

Configure Log Shipper Business Rules for QRadar

  1. Go to Log Shipper > Business Rules.
  2. Click Create New Rule.
  3. Enter a Rule Name and select the filters to use.
  4. Click Save.

Configure Log Shipper SIEM Mappings for QRadar

  1. Go to Log Shipper > SIEM Mappings and click Add SIEM Mapping.
  2. Select a Source Configuration, Business Rule, and Destination Configuration.
  3. Click Save.

Configure the WebTx Mapping

Use this configuration only when it is necessary to send specific WebTx fields in JSON format to the destination platform.

  1. Go to Settings > Log Shipper > Mapping.
  2. Clone the QRadar Default Mappings file.
  3. Enter the name of mapping file.
  4. Select the Editor view radio button.
  5. Scroll down to the “webtx” and enter the specific webtx fields inside the square brackets in double quotes (For example-”sc-status”). In case of multiple fields, use the comma-separated format.


    Refer the Format 3 fields from here to add fields in the webtx.

  6. Go back to the configured plugin and edit the Mapping file.
  7. Disable the toggle button as we want to send data in JSON format.
  8. Configure the SIEM mapping.
  9. Click Save.

Validate the QRadar Plugin

To validate the plugin workflow, you can check from Netskope Cloud Exchange and from your QRadar instance.

Validate in Netskope Cloud Exchange

Go to Logging.


Validate in QRadar

  1. Go to your QRadar instance.
  2. Click Log Activity.
  3. Apply filters to see specific logs.
  4. You can see all logs there.
Share this Doc

QRadar Plugin for Log Shipper

Or copy link

In this topic ...