Forum Discussion

DavidG's avatar
DavidG
Meteor
2 months ago
Solved

eventsFeed.py - Enough?

Hi all, We've started to try and integrate Cato with our Qradar platform. We are ingesting logs using the eventsFeed.py script. This is working well, but I'm curious if I'm "missing" anything or ...
  • peter's avatar
    peter
    2 months ago

    Hello DavidG,

    If you're successfully fetching events using eventsFeed.py then you could also set up separate processes to ingest audit trail events using auditFeed (perhaps using auditFeed.py) and you could also do the same to receive XDR stories using the XDR stories API. Because these queries all work slightly differently and have different rate limits, you probably would need separate pollers.

peter's avatar
peter
Icon for Cato Employee rankCato Employee
2 months ago

Hello DavidG,

If you're successfully fetching events using eventsFeed.py then you could also set up separate processes to ingest audit trail events using auditFeed (perhaps using auditFeed.py) and you could also do the same to receive XDR stories using the XDR stories API. Because these queries all work slightly differently and have different rate limits, you probably would need separate pollers.