Skip to content
downpipes docs

Forward the downpipes audit trail to IBM QRadar

QRadar receives the downpipes audit trail as CEF (or LEEF) carried over real syslog transport. On the scheduler tick the engine shapes each audit event as a CEF line, wraps it as an RFC 5424 syslog record, and writes the batch over one TLS socket to your QRadar collector. QRadar parses that stream through a DSM, but only once you have added the matching log source: there is no auto-parse of a first-time feed.

The one-time step is to add a Universal CEF log source (or Universal LEEF, if you send LEEF) so QRadar’s DSM knows how to read the events. Until that log source exists, QRadar stores the records but does not parse the fields.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

CEF only parses when it arrives over real syslog transport, an RFC 5424 record over TCP with TLS, by default on port 6514, which is the Syslog over TLS delivery. A plain HTTPS POST of a CEF line is never parsed, and the console blocks the CEF-over-HTTP pairing outright. Cloudflare does not document whether a Worker can open an outbound connection to port 6514, so confirm the connection lands from your own engine with Test send before you rely on it.

What you need

  • A QRadar admin account that can add a log source, and the address of the event collector or console that will receive the syslog stream.
  • Owner access to the downpipes console, and a way to confirm your engine can open an outbound TLS connection to your collector on port 6514.

Set it up

  1. In QRadar, add a log source of type Universal CEF (for CEF) or Universal LEEF (for LEEF), set its protocol to receive TLS syslog on port 6514, and note the address the collector listens on. The Universal DSM parses the CEF or LEEF fields once this source exists; without it the events land unparsed.
  2. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  3. Set Delivery to Syslog over TLS, Format to CEF (or LEEF if that is the log source you built), enter your QRadar collector’s address as Syslog host, and leave Port at 6514.
  4. Choose Test send. The engine opens one TLS connection to that host and port and reports whether the batch was written. A test send never advances the delivery cursor. Because the console cannot check port reachability for you, this is where you confirm the connection lands, then check the event appeared and parsed against your log source in QRadar.
  5. With the test written and QRadar showing the event parsed, choose Enable. From the next scheduler tick the engine forwards every audit event above the cursor.

What lands in QRadar

Each event is one CEF line wrapped as an RFC 5424 syslog record and octet-counted per RFC 6587, so QRadar reads exactly one event per record:

CEF:0|Maelstrom AI|Downpipes|<engine version>|restore-approve|Restore approve|3|rt=1750299248221 suser=ops@acme.example src=203.0.113.7 act=restore-approve outcome=success cs3Label=targetKind cs3=restore cn1Label=seq cn1=4097 flexString1Label=hash flexString1=sha384:22cd...01

The act, suser and src fields map to the QRadar dictionary; cn1 carries the sequence number and flexString1 the event hash, which is what QRadar dedups on. LEEF carries the same values under action, usrName, seq and eventHash.

Good to know

  • Delivery is at-least-once, not exactly-once. Every event carries a stable seq and a hash; index on either and a re-sent event lands as a duplicate you can drop rather than a second incident. The feed carries operator identity (member emails, source IPs, roles and approver emails) and no backup data or secret values, so apply your QRadar data-handling rules to it as you would any access log.
  • The same events can be pulled rather than pushed, and QRadar’s Universal Cloud REST API workflow takes that path. For the shared push mechanics and the pull feed, see Forwarding the audit log to your SIEM.

Last updated .