Missing Alerts in the Log Activity Tab in IBM QRadar

Alerts are missing in the Log Activity tab in the Carbon Black Cloud app in QRadar.

• Check whether the Coalescing Events option for the syslog log source is enabled. See Create Syslog Log Source for IBM QRadar.

  

• Make sure that the Event Count for Alerts is greater than one.

  

• You might be reaching the default 4096kb TCP Syslog max payload size. To remediate this, increase the payload. Some alerts exceed 4k, which prevents them from being logged correctly in QRadar. See Increase TCP Syslog Max Payload Size for IBM QRadar.
• Check whether you are reaching your QRadar Event Processor System (EPS) licensed limit. See QRadar: How to view the number of events exceeding the Event Processor System (EPS) licensed limit.
• Update your Carbon Black Cloud app. A known issue in previous versions caused a small percentage of Alerts to not be logged. This issue was resolved in v.2.2.0 of the Carbon Black Cloud app.