When configuring a log source, which protocols are used when receiving data into the event ingress component?

The IBM QRadar event ingress component, typically an Event Collector, receives data using various protocols. The most common listener-based, or "push," protocols are Syslog, SNMP, and HTTP Receiver. Syslog is a standard for forwarding log messages. SNMP (Simple Network Management Protocol) is used to receive trap messages from network devices. The HTTP Receiver protocol allows QRadar to act as a web server, collecting events sent via HTTP/S POST requests, which is common for cloud services and custom applications. These three protocols represent a core set of methods by which external sources actively send event data to be received by QRadar.

A. SFTR HTTP Receiver, SNMP

"SFTR" is not a recognized protocol. This is likely a typographical error for SFTP, which is used by the "Log File" protocol, not as a standalone receiver.

C. Syslog, FTP Receiver, SNMP

QRadar does not have a protocol named "FTP Receiver." It uses the "Log File" protocol to actively pull files from a remote server using FTP, SFTP, or SCP.

D. Syslog, HTTP Receiver, JDBC

While JDBC is a valid protocol for data collection, it is a "pull" mechanism where QRadar actively queries a database, rather than a "push" mechanism where QRadar passively receives data like Syslog or SNMP traps. Option B is more consistent as it lists only push/listener protocols.

1. IBM Security QRadar Log Source Management Guide (Version 7.5.0): This official guide details the protocols available for log source configuration.

Syslog Protocol: "Use the Syslog protocol to receive events from network devices that support sending syslog events to a remote syslog daemon." (Chapter 2: Log source protocol configuration options, "Syslog protocol" section).

SNMP Protocols: "Use the SNMP protocols to configure QRadar to receive SNMP traps (v1, v2, or v3) from devices on your network that are configured to generate SNMP events." (Chapter 2: Log source protocol configuration options, "SNMPv1/SNMPv2/SNMPv3 protocol" sections).

HTTP Receiver Protocol: "Use the HTTP Receiver protocol to configure a log source to receive events by using HTTP or HTTPS." (Chapter 2: Log source protocol configuration options, "HTTP Receiver protocol" section).

JDBC Protocol: This guide describes the JDBC protocol as a method where QRadar connects to a database to "poll for and retrieve events," confirming its nature as a pull mechanism. (Chapter 2: Log source protocol configuration options, "JDBC protocol" section).

Log File Protocol: This guide explains that the Log File protocol is used to "retrieve event files from a remote host" using methods like FTP, SFTP, and SCP, confirming it is a pull mechanism and that "FTP Receiver" is not the correct terminology. (Chapter 2: Log source protocol configuration options, "Log File protocol" section).