Pull logs from ServiceNow to QRadar with OOTB Plugin?

[Angel R]

We are using SIEM solution QRadar and we need to come up with a solution that pulls the event logs from the syslog and sysevent table in ServiceNow.

We're interested in user events to begin with, do you know if "IBM QRadar Integration for Security Operations" plugin allows that or this is just to push information from QRadar? Is there any other solution OOTB to do that?

Thanks in advance.

Kind Regards.

[Rahul Priyadars]

we have done Similar Integration with SPLUNK using a Connector refer community thread - https://community.servicenow.com/community?id=community_question&sys_id=f5d9f3c01be48950aefc11751a4bcb1b

In case of IBM Q-Radar-- connector is to Push from Qradar to Sec-Ops module not the  way around you are looking for. 

Probably a REST GET Call from Q-Radar to Service Now conceptually works , But Its tricky to set how frequent. 

We're interested in user events to begin with, do you know if "IBM QRadar Integration for Security Operations" plugin allows that  --> NO OOTB.

See if it helps u- https://docs.servicenow.com/en-US/bundle/sandiego-platform-administration/page/integrate/vendor-specific-integrations/reference/r_SyslogProbe.html

Regards

RP

[Angel R]

Thank you for your comment Rahul.