1. Logon to TMCM server with admin privileges
2. Navigate to ...\Trend Micro\Control Manager and search for Logforwarder.exe.
3. Run the Logforwarder.exe application as an administrator.
4. Configure the following information in the Logforwarder Tool:
   • Host: IP address of IBM Qradar
   • Protocol: UDP
   • Port: 514
   • Facility: Local0
   • Severity: Notice

   For the Log Forwarding Settings section, select the preferred options:

   

   • Frequency: denotes the time interval when the tool will send the selected logs
   • Format: CEF or CM (Default value is CEF and more readable)
   • Logs to forward: multiple logs can be selected, but the tool will send by the order that is listed (e.g. if both C&C Callback and DLP logs are selected, the tool will send the C&C Callback logs first, before sending the DLP logs).
5. Click Start, and then click Yes on the Log Forwarder pop-up window.

1. Logon to IBM QRadar console, then go to Admin > Log Sources.
2. Create a new Log Source
3. Configure the Setting of TMCM in Log Source page:
   • Log Source Name: TMCM server
   • Log Source Description: describes the info of the TMCM Logs
   • Protocol Configuration: Syslog
   • Log Source Identifier: IP Address of the TMCM server
    

   Protocol Configuration for Logforwarder is SYSLOG. If Syslog is not available in Protocol Configuration, inform customer to coordinate it to IBM Team.

    

   

4. Click Save.

After completing the configuration on both TMCM and IBM QRadar, confirm if the logs are sent without issues. Do the steps below:

1. Enable TMCM_Logforwarder.log in TMCM server. Refer to this KB article: Enabling debug for Logforwarder.exe in Control Manager (TMCM) / Apex Central
2. Run TCPDUMP in IBM QRadar Appliance. You can check this article from IBM: Verifying that QRadar receives syslog events