QRadar

The QRadar destination forwards logs from Bindplane to IBM QRadar SIEM over syslog. Bindplane sends each log record to a QRadar syslog endpoint using TCP or UDP, with optional TLS encryption. This destination supports logs only.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A reachable QRadar log source that accepts syslog, with its host and port (for example, a QRadar Event Collector or a configured log source on the QRadar console).
• Network connectivity from the collector to the QRadar endpoint over the chosen transport (TCP or UDP).
• For TLS, the QRadar log source configured to accept TLS syslog, plus any certificate, private key, and certificate authority files the collector needs.

Configuration

Logs

Parameter	Type	Default	Description
Field to Send	Enum	Body	Required. The telemetry field to send. One of Body or Attributes.
Body Field	OTTL Field		The body field to send. Use bracket notation for nested fields. An empty value sends all body fields. Shown when raw_base is Body.
Attributes Field	OTTL Field		The attributes field to send. Use bracket notation for nested fields. An empty value sends all attribute fields. Shown when raw_base is Attributes.

QRadar

Parameter	Type	Default	Description
QRadar Endpoint	String		Required. The QRadar syslog endpoint to send logs to.
Transport Protocol	Enum	tcp	The transport protocol to use. One of tcp or udp.

TLS (Advanced)

Parameter	Type	Default	Description
Enable TLS	Boolean	false	Whether or not to use TLS.
Skip TLS Certificate Verification	Boolean	false	Skip TLS certificate verification. Shown when enable_tls is true.
TLS Certificate File	String		Path to the x509 PEM certificate (required for mutual TLS). Shown when enable_tls is true.
TLS Private Key File	String		Path to the x509 PEM private key (required for mutual TLS). Shown when enable_tls is true.
TLS Certificate Authority File	String		Path to the x509 PEM certificate authority file. Shown when enable_tls is true.

Advanced

Parameter	Type	Default	Description
Drop Raw Copy	Boolean	true	When enabled, the raw copy of the log stored in log.record.original is dropped.

Retry on Failure (Advanced)

Parameter	Type	Default	Description
Enable Retry on Failure	Boolean	true	Attempt to resend logs that have failed to be transmitted to the destination.
Initial Interval	Integer	5	Time (in seconds) to wait after the first failure before retrying. Shown when retry is enabled.
Max Interval	Integer	30	The upper bound (in seconds) on backoff. Shown when retry is enabled.
Max Elapsed Time	Integer	300	The maximum amount of time (in seconds) spent trying to send a batch, to avoid a never-ending retry loop. Shown when retry is enabled.

Sending Queue (Advanced)

Parameter	Type	Default	Description
Enable Sending Queue	Boolean	true	Buffer logs temporarily before sending to help ensure data is not lost during a temporary network outage.
Number of Consumers	Integer	10	Number of consumers that dequeue batches. Shown when the sending queue is enabled.
Queue Size	Integer	5000	Maximum number of batches kept in memory before dropping. Shown when the sending queue is enabled.
Enable Persistent Queuing	Boolean	true	Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Shown when the sending queue is enabled.
Persistent Queue Storage	Extension		Required. The storage to use for the persistent queue. Shown when the sending queue and persistent queue are enabled.

Example Configuration

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: qradar
  name: qradar
spec:
  type: qradar
  parameters:
    - name: raw_base
      value: 'Body'
    - name: raw_body
      value: ''
    - name: qradar_endpoint
      value: 'qradar.example.com:514'
    - name: qradar_transport
      value: 'tcp'
    - name: enable_tls
      value: 'false'

Configuration Tips

Selecting what to send

• Set raw_base to Body to forward the log body, or Attributes to forward log attributes. The matching field selector (raw_body or raw_attributes) controls which nested field is sent.
• Leave the field selector empty to send all fields of the selected base. Use bracket notation (for example, ["message"]) to send a single nested field.

Transport and TLS

• Use tcp transport when delivery reliability matters. udp is lighter weight but can drop records under load.
• Enable TLS to encrypt syslog traffic. For mutual TLS, set cert_file and key_file so the collector presents a client certificate, and set ca_file to verify the QRadar endpoint.

Troubleshooting

Symptom: No events appear in QRadar. Solution: Confirm the collector can reach qradar_endpoint over the configured transport, and that the QRadar log source is listening on that host and port. A TCP endpoint will not receive UDP traffic and vice versa, so make sure qradar_transport matches the QRadar log source protocol.

Symptom: The connection fails when TLS is enabled. Solution: Verify the QRadar log source is configured for TLS syslog. If the endpoint uses a private or self-signed certificate, supply the issuing authority with ca_file, or set insecure_skip_verify to true for testing only. For mutual TLS, ensure cert_file and key_file are both set and readable by the collector.

Symptom: Events arrive but contain more fields than expected. Solution: Narrow the payload with raw_base plus raw_body or raw_attributes. Leaving the selector empty sends every field of the selected base.

Related Resources

• IBM QRadar SIEM documentation
• IBM QRadar log source management
• Retry on Failure settings
• Sending Queue settings
• Persistent Queue settings