Configure Polling Settings for IBM QRadar

If you ingest Audit Log or Alert data in the Carbon Black Cloud app for QRadar, you must enable Polling.

Prerequisites

• Install and Configure the Carbon Black Cloud App for IBM QRadar.
• You must have privileges to access the Carbon Black Cloud app to configure the polling data.

Procedure

1. Open the Carbon Black Cloud app in the QRadar console.
2. Go to Settings > Data.
3. Under Polling, toggle Polling Status to Enabled.

   After polling is enabled, the page displays the last time that the Carbon Black Cloud app polled Carbon Black Cloud for data.

4. Optional: Change the polling interval to a value between 60 and 600 seconds. The default value is 180 seconds.

   

5. Click Save.

What to do next

Configure Alert and Audit Log Data for IBM QRadar