Logs from Azure are encrypted on Qradar

Joe

Hello everyone

we are integrating CATO to send events to an azure and from there our SIEM service will collect the logs using Qradar.

The workflow is:

Cato > container > logic app > event hub.

we are getting logs on Qradar but they seem to be encrypted.

when we download the logs from the container to a local PC they are readable.

this is my first attempt with azure integration so i have no idea where too start.. 

Thanks

peter

Hello Joe,

If those log files have been pushed using our Event Log feature, they will be gzipped.