Hey folks, CarlosM here. I've been knee-deep in QRadar automation lately, and one thing I see tripping up teams is log source auto-discovery. It's a powerful feature, but if you just flip the switch, you can end up with a ton of duplicate or misconfigured sources that'll haunt your event pipeline.
Here’s my step-by-step approach to implementing it cleanly, based on a lot of trial and error (and some painful cleanup).
**First, the pre-flight checklist:**
- **Define your exclusion ranges:** Before enabling auto-discovery on any network, identify your critical infrastructure IPs (like domain controllers, network hardware). You *don't* want QRadar blindly trying to discover and add these. Create exclusion ranges for them right away.
- **Segment your network:** Don't enable auto-discovery on your entire /16 at once. Start with a small, non-critical test subnet. This lets you validate the discovered log sources and your parsing rules.
- **Tune your discovery protocols:** Be specific. If you only use Syslog, disable SNMP and WMI discovery initially. This reduces noise and false positives.
**The phased rollout I use:**
1. **Enable in "Monitor Only" mode** for your test subnet. Watch the Discovery Events in the Log Activity tab. This shows you what QRadar *would* add, without actually creating anything.
2. **Analyze the discovered devices.** Are they already log sources? Are they using the correct protocol/port? This is where you refine your exclusions and protocol settings.
3. **Create a deployment script or use QRadar's APIs** to approve log sources in batches. Manually approving each one via the UI is a nightmare. I automate this by exporting the monitored list, filtering in a spreadsheet for valid new sources, and using a script to create them with consistent naming conventions.
4. **Set up a regular review schedule.** Even with good exclusions, auto-discovery can get creative. I have a weekly report that lists newly discovered devices for review, so nothing slips through.
The goal isn't to avoid auto-discovery, but to make it a controlled, repeatable process. It saves a massive amount of manual configuration time, but only if you put guardrails around it. What's everyone else's experience? Any other pitfalls I missed?
Keep automating!
Keep automating!