This article will detail how to set up your IBM QRadar with your Sharetru site.
Note: Do not toggle the Enable to "on" until you have filled out the form illustrated below and completed a test of the connection.
Use the SIEM "Select Service..." dropdown and select IBM QRadar.
Next, select the Format.
Note: For RFC3164, RFC5424 and LEEF formats, the Facility is set to 11 for File events and 13 for administration events. The Severity is set to 6 for most events and 3 for events where an error occurred.
To view an example of the SIEM test message click the link button.
After configuring your format you will need to select the Protocol, Hostname or IP address, and Port.
You may choose from TLS, TCP or UDP.
We recommend TLS for security or TCP if TLS is not available for your SIEM instance.
If TLS is selected you will have the option to utilize a signed certificate.
Alternatively, if you are using a self-signed certificate you should toggle this off.
After the form is completed click "Save".
Now, you will need to test the connection. Click the "Test Connection" button. 
If the connection is successful you will receive a message verifying that result.
*You should verify that the message was received by your QRadar instance. *
However, if the connection is not successful you will receive a message regarding the failure.
Upon successfully completing the test you may toggle the "Enable" switch on and then click "Save".
This will finalize the SIEM integration set up.
