Which statement is true about Cloud Pak for Data SIEM integration?

The IBM Cloud Pak for Data Audit Logging Service is built upon the Fluentd data collector. It utilizes Fluentd's capabilities to gather audit records generated by various Cloud Pak for Data services. For external integration, it uses Fluentd's output plugins to forward these records to Security Information and Event Management (SIEM) systems. This architecture allows for flexible configuration to route audit data to one or more external monitoring solutions like QRadar or Splunk.

A. Not all services generate audit records. While most core services do, the official documentation provides a specific list of services that support audit logging, implying it is not a universal feature across every component.
C. Different connection methods can be used for multiple SIEM systems. The underlying Fluentd configuration allows for separate directives, enabling, for example, one SIEM to receive logs via syslog and another via an HTTP endpoint.
D. The documentation explicitly mentions and provides configuration examples for IBM QRadar and Splunk. While other SIEMs can be integrated using standard protocols, Log360 is not listed as an officially supported solution.

1. IBM Cloud Pak for Data 4.8 Documentation

"Exporting Cloud Pak for Data audit records to your security information and event management solution."

This document states

"The audit logging service uses Fluentd to forward and export audit records." This directly supports the correct answer (B). It also provides configuration examples for QRadar and Splunk

but not Log360

which refutes option D. The ability to add multiple

distinct configurations in the zen-audit-fluentd-forwarder-config ConfigMap refutes option C.

2. IBM Cloud Pak for Data 4.8 Documentation

"Audit logging in Cloud Pak for Data."

This section mentions

"By default

audit logging is enabled for all services that are installed. However

only the services that generate audit events will send records to the audit logging service." This

along with the specific list on the "Services that generate audit records" page

confirms that not every single component necessarily generates logs

refuting the absolute claim in option A.