moving field data from sql audit to logbinder to qradar


moving field data from sql audit to logbinder to qradar

m

, I attended your webinar on logbinder use on sql server, myquestion is how easy is it to simply grab the data from various sql tablefields and moving them to the binary audit file?  Our sql server is setupsolely to store data fed from our software product so we are wanting to takeselected data we collect and move to the logbinder and then to Qradar or anySIEM, for event correlation, thanks much.


bjvista

mwaldis - 3/5/2018

, I attended your webinar on logbinder use on sql server, myquestion is how easy is it to simply grab the data from various sql tablefields and moving them to the binary audit file?  Our sql server is setupsolely to store data fed from our software product so we are wanting to takeselected data we collect and move to the logbinder and then to Qradar or anySIEM, for event correlation, thanks much.


You first setup your SQL audit spec in SQL Server.  This is done within SQL, not with LOGbinder.  You can find more information here.  When configuring the audit in SQL there is an option there to tell it to output it's audit data to the binary file and also the location for that file.  That is all within SQL Server.

We also have an Audit Policy Wizard available at UltimateWindowsSecurity.com that will make it much easier to configure your SQL audit.

Once that is configured, you install LOGbinder, tell it the location of binary file and then tell LOGbinder what format (since you're using Qradar I'm assuming LEEF) to output the audit data and where (with Qradar you have two options, LEEF via a syslog server or LEEF via a flat file that Qradar consumes).  

It may sound like a lot of configuring but this is easily something you can setup in under 30 minutes.  You can find more info about installing and configuring LOGbinder for SQL Server in our Getting Started Guide here.



GO


Similar Topics


Reading This Topic


Login
Existing Account
Email Address:


Password:


Select a Forum....








LOGbinder Forum


Search