Configuring Secret Server On-Prem

This section describes how to enable logging in Delinea Secret Server On-Prem to forward syslog-formatted events to IBM QRadar. You’ll configure Secret Server On-Prem to send CEF or Syslog logs to the appropriate QRadar IP and port to initiate log collection.

1. Log in to Secret Server.

2. Go to Settings >Application

   

3. Select Edit.

   

4. Set the Enable Syslog /CEF Log Output option to Yes

5. Enable SIEM Logging:

   1. In the Syslog/CEF Server field, enter the QRadar IP address

   2. In the Syslog/CEF Port field, enter 514 (for TCP protocol)

6. Save the configuration.