> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/qradar.md).

# QRadar

The QRadar destination forwards logs from Bindplane to [IBM QRadar SIEM](https://www.ibm.com/docs/en/qsip) over syslog. Bindplane sends each log record to a QRadar syslog endpoint using TCP or UDP, with optional TLS encryption. This destination supports logs only.

### Supported Telemetry Types

| Platform | Metrics | Logs | Traces |
| -------- | ------- | ---- | ------ |
| Linux    |         | ✓    |        |
| Windows  |         | ✓    |        |
| macOS    |         | ✓    |        |

### Prerequisites

* A reachable QRadar log source that accepts syslog, with its host and port (for example, a QRadar Event Collector or a configured log source on the QRadar console).
* Network connectivity from the collector to the QRadar endpoint over the chosen transport (TCP or UDP).
* For TLS, the QRadar log source configured to accept TLS syslog, plus any certificate, private key, and certificate authority files the collector needs.

### Configuration

<figure><img src="/files/5PmYDYzz90xK25EJe1ec" alt="Bindplane docs - QRadar - image 1"><figcaption></figcaption></figure>

#### Logs

| Parameter        | Type       | Default | Description                                                                                                                                             |
| ---------------- | ---------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Field to Send    | Enum       | `Body`  | **Required.** The telemetry field to send. One of `Body` or `Attributes`.                                                                               |
| Body Field       | OTTL Field |         | The body field to send. Use bracket notation for nested fields. An empty value sends all body fields. Shown when `raw_base` is `Body`.                  |
| Attributes Field | OTTL Field |         | The attributes field to send. Use bracket notation for nested fields. An empty value sends all attribute fields. Shown when `raw_base` is `Attributes`. |

#### QRadar

| Parameter          | Type   | Default | Description                                               |
| ------------------ | ------ | ------- | --------------------------------------------------------- |
| QRadar Endpoint    | String |         | **Required.** The QRadar syslog endpoint to send logs to. |
| Transport Protocol | Enum   | `tcp`   | The transport protocol to use. One of `tcp` or `udp`.     |

#### TLS (Advanced)

| Parameter                         | Type    | Default | Description                                                                                    |
| --------------------------------- | ------- | ------- | ---------------------------------------------------------------------------------------------- |
| Enable TLS                        | Boolean | `false` | Whether or not to use TLS.                                                                     |
| Skip TLS Certificate Verification | Boolean | `false` | Skip TLS certificate verification. Shown when `enable_tls` is `true`.                          |
| TLS Certificate File              | String  |         | Path to the x509 PEM certificate (required for mutual TLS). Shown when `enable_tls` is `true`. |
| TLS Private Key File              | String  |         | Path to the x509 PEM private key (required for mutual TLS). Shown when `enable_tls` is `true`. |
| TLS Certificate Authority File    | String  |         | Path to the x509 PEM certificate authority file. Shown when `enable_tls` is `true`.            |

#### Advanced

| Parameter     | Type    | Default | Description                                                                       |
| ------------- | ------- | ------- | --------------------------------------------------------------------------------- |
| Drop Raw Copy | Boolean | `true`  | When enabled, the raw copy of the log stored in `log.record.original` is dropped. |

#### Retry on Failure (Advanced)

| Parameter               | Type    | Default | Description                                                                                                                            |
| ----------------------- | ------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Enable Retry on Failure | Boolean | `true`  | Attempt to resend logs that have failed to be transmitted to the destination.                                                          |
| Initial Interval        | Integer | `5`     | Time (in seconds) to wait after the first failure before retrying. Shown when retry is enabled.                                        |
| Max Interval            | Integer | `30`    | The upper bound (in seconds) on backoff. Shown when retry is enabled.                                                                  |
| Max Elapsed Time        | Integer | `300`   | The maximum amount of time (in seconds) spent trying to send a batch, to avoid a never-ending retry loop. Shown when retry is enabled. |

#### Sending Queue (Advanced)

| Parameter                 | Type      | Default | Description                                                                                                                                                         |
| ------------------------- | --------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable Sending Queue      | Boolean   | `true`  | Buffer logs temporarily before sending to help ensure data is not lost during a temporary network outage.                                                           |
| Number of Consumers       | Integer   | `10`    | Number of consumers that dequeue batches. Shown when the sending queue is enabled.                                                                                  |
| Queue Size                | Integer   | `5000`  | Maximum number of batches kept in memory before dropping. Shown when the sending queue is enabled.                                                                  |
| Enable Persistent Queuing | Boolean   | `true`  | Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. Shown when the sending queue is enabled. |
| Persistent Queue Storage  | Extension |         | **Required.** The storage to use for the persistent queue. Shown when the sending queue and persistent queue are enabled.                                           |

### Example Configuration

#### Standalone Destination

```yaml
apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: qradar
  name: qradar
spec:
  type: qradar
  parameters:
    - name: raw_base
      value: 'Body'
    - name: raw_body
      value: ''
    - name: qradar_endpoint
      value: 'qradar.example.com:514'
    - name: qradar_transport
      value: 'tcp'
    - name: enable_tls
      value: 'false'
```

### Configuration Tips

#### Selecting what to send

* Set `raw_base` to `Body` to forward the log body, or `Attributes` to forward log attributes. The matching field selector (`raw_body` or `raw_attributes`) controls which nested field is sent.
* Leave the field selector empty to send all fields of the selected base. Use bracket notation (for example, `["message"]`) to send a single nested field.

#### Transport and TLS

* Use `tcp` transport when delivery reliability matters. `udp` is lighter weight but can drop records under load.
* Enable TLS to encrypt syslog traffic. For mutual TLS, set `cert_file` and `key_file` so the collector presents a client certificate, and set `ca_file` to verify the QRadar endpoint.

### Troubleshooting

**Symptom:** No events appear in QRadar. **Solution:** Confirm the collector can reach `qradar_endpoint` over the configured transport, and that the QRadar log source is listening on that host and port. A TCP endpoint will not receive UDP traffic and vice versa, so make sure `qradar_transport` matches the QRadar log source protocol.

**Symptom:** The connection fails when TLS is enabled. **Solution:** Verify the QRadar log source is configured for TLS syslog. If the endpoint uses a private or self-signed certificate, supply the issuing authority with `ca_file`, or set `insecure_skip_verify` to `true` for testing only. For mutual TLS, ensure `cert_file` and `key_file` are both set and readable by the collector.

**Symptom:** Events arrive but contain more fields than expected. **Solution:** Narrow the payload with `raw_base` plus `raw_body` or `raw_attributes`. Leaving the selector empty sends every field of the selected base.

### Related Resources

* [IBM QRadar SIEM documentation](https://www.ibm.com/docs/en/qsip)
* [IBM QRadar log source management](https://www.ibm.com/docs/en/qsip/7.5?topic=management-log-sources)
* [Retry on Failure settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/retry-on-failure)
* [Sending Queue settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/sending-queue)
* [Persistent Queue settings](https://docs.bindplane.com/configuration/bindplane-otel-collector/persistent-queue)

```
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/integrations/destinations/qradar.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.