Manual Setup of App Control as Event Source

You can manually configure App Control as the source of events sent to the QRadar Log Manager.

To configure Carbon Black App Control as an event source for QRadar Log Manager:

1. In the QRadar Log Manager Console, click on the Admin tab.
2. On the console Admin settings, under Data Sources/Events, click Log Sources. The Log Sources window opens.
3. In the Log Source window menu bar, click Add. The Add a Log Source window opens.
4. In the new window, for Log Source Name, enter Carbon Black App Control.
5. For Log Source Description, enter Carbon Black App Control Server.
6. Choose Carbon Black App Control on the Log Source menu.
7. For Log Source Identifier, enter the fully qualified domain name of the Carbon Black App Control Server sending the events.
8. Set Credibility to 10.
9. Click the Save button.
10. On the QRadar Log Manager Admin console, click Deploy Changes in the Admin menu bar.