Configuring Secret Server On-Prem

This section describes how to enable logging in Delinea Secret Server On-Prem to forward syslog-formatted events to IBM QRadar. You’ll configure Secret Server On-Prem to send CEF or Syslog logs to the appropriate QRadar IP and port to initiate log collection.

1. Log in to Secret Server.

2. Go to Settings >Application

   

3. Select Edit.

   

4. Set the Enable Syslog /CEF Log Output option to Yes

5. Enable SIEM Logging:

   1. In the Syslog/CEF Server field, enter the QRadar IP address.

      The Log Source Identifier refers to the device sending logs to QRadar (the Secret Server host), not the QRadar collector itself.

   2. In the Syslog/CEF Port field, enter 514 (for TCP protocol).

6. Save the configuration.