Skip to content
  • siem
  • qradar leef

QRadar LEEF over TLS

The QRadar sink delivers Alphyn events as IBM QRadar Log Event Extended Format (LEEF) 2.0 records wrapped in an RFC 5424 syslog frame over TLS. LEEF is native to IBM QRadar, so its DSM engine maps the attributes directly into QRadar event properties.

Configure it in the Alphyn dashboard under Integrations, using integration key qradar_leef.

Configuration

Section titled “Configuration”

The QRadar sink uses the same endpoint and TLS fields as the Syslog CEF sink:

FieldRequiredDefaultDescription
hostYes-Hostname or IP of the QRadar event collector or console.
portNo6514TLS syslog port on the collector.
ca_certNo-PEM certificate used to pin QRadar’s CA and validate the server.
client_certNo-PEM client certificate for mutual TLS.
client_keyNo-PEM private key paired with client_cert for mutual TLS.
framingNooctet_countingFrame delimiting: octet_counting (RFC 6587) or newline.

TLS is always required for this sink. Provide ca_cert to pin QRadar’s issuing CA, and supply the client_cert and client_key pair when the collector requires mutual TLS.

Record format

Section titled “Record format”

Each event is a LEEF 2.0 record inside a standard syslog header. LEEF 2.0 declares its attribute delimiter in the header; Alphyn uses a tab (x09):

LEEF:2.0|Byteria|Alphyn|<schemaVersion>|<eventID>|x09|<tab-separated attributes>

The attribute set differs between the THREAT and AUDIT families; the full attribute tables are on the Parsing and field mapping page.

THREAT example

Section titled “THREAT example”
<134>1 2026-07-16T09:41:22.000Z alphyn.byteria.dev alphyn - - - LEEF:2.0|Byteria|Alphyn|1|ROOT-V1|x09|cat=ROOT  sev=9  src=203.0.113.24  externalId=evt_8f21a0  deviceExternalId=dev_5521  msg=Root management binary present  packageName=com.acme.banking  appVersion=4.8.1  appHash=9ad1f0c4  os=Android 14  eventType=SECURITY_SIGNAL  tenantId=acme  occurredAt=2026-07-16T09:41:21.880Z

AUDIT example

Section titled “AUDIT example”
<134>1 2026-07-16T09:42:05.000Z alphyn.byteria.dev alphyn - - - LEEF:2.0|Byteria|Alphyn|1|API_KEY_REVOKED|x09|sev=5  usrName=jsmith  src=198.51.100.9  externalId=aud_2b70e1  actorId=usr_104  [email protected]  resourceType=ApiKey  resourceId=key_7781  cat=API_KEY  eventType=API_KEY_REVOKED  tenantId=acme  occurredAt=2026-07-16T09:42:04.900Z  userAgent=Mozilla/5.0

Setup on the QRadar side

Section titled “Setup on the QRadar side”
  1. Add a TLS Syslog log source (or configure the TLS Syslog protocol on your event collector) to receive events on the port you will set as port.
  2. Note QRadar’s TLS server certificate chain. Export the issuing CA as PEM if you want Alphyn to pin it via ca_cert, and issue a client certificate for Alphyn if the collector requires mutual TLS.
  3. In the Alphyn dashboard, add a QRadar LEEF over TLS integration, enter host, port, and any certificate fields, and set the delivery filter.
  4. Click Test connection to deliver a synthetic event through the real TLS transport, then confirm it arrives in QRadar.
  5. QRadar parses LEEF attributes natively. To surface the Alphyn attributes as named custom properties, use the LEEF attribute reference on the Parsing and field mapping page, or the downloadable QRadar / ArcSight field reference.