# Integration of SailPoint IIQ with QRadar to monitor audit activities

**URL:** <https://developer.sailpoint.com/discuss/t/integration-of-sailpoint-iiq-with-qradar-to-monitor-audit-activities/19988>\
**Category:** IIQ Discussion and Questions\
**Tags:** identityiq\
**Created:** [October 31, 2023, 6:32am UTC](https://developer.sailpoint.com/discuss/t/integration-of-sailpoint-iiq-with-qradar-to-monitor-audit-activities/19988 "2023-10-31T06:32:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![milinaphalke](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@milinaphalke](https://developer.sailpoint.com/discuss/u/milinaphalke)\
**Post date:** [October 31, 2023, 6:32am UTC](https://developer.sailpoint.com/discuss/t/integration-of-sailpoint-iiq-with-qradar-to-monitor-audit-activities/19988/1 "2023-10-31T06:32:20Z")

</div>

Hi All,

We are in the process to integrate SailPoint with SIEM system.

So, we want the SIEM (QRadar) to monitor all the auditevent actions like login, login failure, password change etc.

So, we were looking for SailPoint logs which will log all the audit related activities.

Have browsed through the forums and noticed the suggestion to use spt\_audit\_event table.

Is it good way to allow QRadar to read the spt\_audit\_event table ? Did anyone implement this solution at their customer end.

Please share inputs.

Thanks & Regards,

Milina Phalke

---

<div class="post-metadata">

**Author:** ![KRM7](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/krm7/32/2685_2.png) [@KRM7](https://developer.sailpoint.com/discuss/u/KRM7)\
**Post date:** [November 1, 2023, 12:37pm UTC](https://developer.sailpoint.com/discuss/t/integration-of-sailpoint-iiq-with-qradar-to-monitor-audit-activities/19988/2 "2023-11-01T12:37:11Z")

</div>

Alternatively you can use [SIEM Plugin](https://community.sailpoint.com/t5/Plugin-Framework/SailPoint-SIEM-Plugin/ta-p/139558) as well.

> [@milinaphalke](#):
>
> Is it good way to allow QRadar to read the spt\_audit\_event table

I don’t see any issue with that, I would go for read only permission.

In one of my clients, We integrated with Splunk with config in log4j. Splunk reads all the SailPoint logs, send us an email if there are any errors.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 31, 2023, 12:37pm UTC](https://developer.sailpoint.com/discuss/t/integration-of-sailpoint-iiq-with-qradar-to-monitor-audit-activities/19988/3 "2023-12-31T12:37:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.