When setting up syslog transfer between Cynet 360 and IBM Security QRadar SIEM you must perform the following steps:Configure Cynet 360 to send syslog to QRadar. See instructions here. Verify that QRadar is receiving the logs.Create a new Log Source in QRadar and map log properties and events so that Cynet 360 logs are interpreted correctly.Map events and configure Cynet 360 as a Log Source.To verify that QRadar is receiving logs:Log into QRadar as root over SSH. If the syslog destination is different appliance, such as an event collector, use SSH to the event collector.Run the following commands:tcpdump -nnAs0 -i eth0 host and port 514 is the IPv4 address or hostname of the Cynet 360 server sending the logs to QRadar Replace eth0  with the name of the QRadar network interface. Logs are displayed in the SSH session.To create a new Log Source and map properties:Log in to the IBM QRadar UI and navigate to the Admin menu.Select DSM Editor, then click Create new.For Log Source Type enter CynetServer, then click select.The Log Source CynetServer is created.In the newly created log source, navigate to the Properties Tab and click +. You must create a new Custom Property Definition for every field you want to map from the log.Click Create New.Enter a name for the Custom Property Definition and click Save. See a table of properties below.A new Custom Property Definition is created.Select the Custom Property Definition you created.Select Expression Type CEF and enter the corresponding expression from the log.Repeat steps 6-8 for each property in the following table:Custom Property NameExpressionValue ExampleHeader Custom Propertiescynet_cefversion$cefversion$CEF:0cynet_vendor$vendor$Cynetcynet_product$product$Cynet 360cynet_version$version$4.2.11.10895cynet_id$id$NAcynet_name$name$Process Monitoringcynet_severity$severity$8External Custom PropertiesEvent IDexternalId147cynet_ clientIdclientId100500Log message example:CEF:0|Cynet|Cynet 360|4.2.11.10895|0|Process Monitoring|8| externalId=147 clientId=100500 Navigate to the Event Mapping Tab and click +. To configure Cynet 360 as a Log Source:From Admin > Data Sources and select Log Sources.Select the following parameters:Log source type: Universal CEFProtocol type: SyslogEnter the following Log Source Parameters:Name: Cynet360Description: Cynet360 serverEnabled: YesGroup: select the desired groupTarget event collector: select the log collector that receives the logsLog source identifier: Cynet server IP addressClick Deploy Changes.Once the configuration is deployed you can view the parsing results in the Log Activity tab.