Skip to content
Notifications
Clear all

QRadar and cloud logs (AWS CloudTrail, Azure Activity). Does it handle the volume well?

1 Posts
1 Users
0 Reactions
1 Views
(@devops_rookie_2025)
Reputable Member
Joined: 2 months ago
Posts: 203
Topic starter   [#16395]

Hi everyone! I'm just starting out with SIEM tools and had a question about QRadar in a cloud context.

We're looking at ingesting AWS CloudTrail and Azure Activity logs. From what I've read, these can get really chatty. For those who have done this, does QRadar handle the high event volume okay without needing a huge amount of tuning right away? I'm curious about the out-of-the-box experience.

I saw something about needing to adjust the "Azure Activity Log" protocol parameters to avoid missing events. Is that a common first step? Any beginner-friendly tips would be awesome 😊

Thanks in advance for any guidance!



   
Quote