topic Re: Combine Log Exporter filters in Events

Combine Log Exporter filters

Agust — Wed, 24 Apr 2024 15:50:29 GMT

Hi guys!

We are looking to implement two combined filters for log exporter.
On one side we have the following filter that we want to apply:
# cp_log_export set name "name" filter-blade-in TP

and on the other hand we also want to export to the server the logs of the audit type.
Is there a way to combine both?
Thank you.

Re: Combine Log Exporter filters

PhoneBoy — Fri, 26 Apr 2024 16:31:56 GMT

Just to confirm what you're intending, you want to send both audit logs (all of them) and Security Logs that are for a specific blade?
In this case, you may need to create two connections to the same server, one that just sends audit logs (no filter) and one that has the specific filter for security logs.

Re: Combine Log Exporter filters

Agust — Fri, 26 Apr 2024 19:55:40 GMT

Hello Phoneboy.
Thank you for your reply
We currently apply a filter for Threat prevention blades using the following filter

#cp_log_export set name qradar filter-blade-in TP

As you say we should generate another configuration in parallel to the target server that bears another name different from "qradar" and have applied the filter to send only audit logs?

Regards!

Re: Combine Log Exporter filters

PhoneBoy — Mon, 29 Apr 2024 14:34:25 GMT

I believe this is the only way to achieve this.