Integration of SailPoint IIQ with QRadar to monitor audit activities

[milinaphalke]

Hi All,

We are in the process to integrate SailPoint with SIEM system.

So, we want the SIEM (QRadar) to monitor all the auditevent actions like login, login failure, password change etc.

So, we were looking for SailPoint logs which will log all the audit related activities.

Have browsed through the forums and noticed the suggestion to use spt_audit_event table.

Is it good way to allow QRadar to read the spt_audit_event table ? Did anyone implement this solution at their customer end.

Please share inputs.

Thanks & Regards,

Milina Phalke

[MVKR7T (Krishna Reddy Mummadi)]

Alternatively you can use SIEM Plugin as well.

@milinaphalke

Is it good way to allow QRadar to read the spt_audit_event table

I don’t see any issue with that, I would go for read only permission.

In one of my clients, We integrated with Splunk with config in log4j. Splunk reads all the SailPoint logs, send us an email if there are any errors.