Hello eveyone   we’re experiencing with consuming Kafka from a third-party (Qradar) system outside of CDP. In their configuration, the only SASL mechanisms available for configuration are: PLAIN SCRAM-SHA-256 SCRAM-SHA-512 However, all of these mechanisms are resulting in authentication errors. how we can connect Qradar to kafa to be able to consume the data from kafka  Thanks in advance    ... View more

Hello, I need your guidance on the following scenario: We have a SIEM (QRadar) infrastructure where Event Collectors receive logs from various data sources. These logs are correlated based on SIEM rules and use cases. we plan to send logs to the SIEM while also storing a copy in a Data Lake. Current Approach: We have structured the workflow as follows: DATA SOURCES → NiFi → Store in DATA LAKE & Forward to SIEM (using PUTTCP processor) Questions: Does NiFi allow segregation of data sources? Handling LEEF logs: logs reach NiFi with the original source IP but leave NiFi with NiFi’s source IP. Since QRadar first looks for the hostname in the payload (and if absent, uses the source IP), this could cause misidentification. Can NiFi be configured to retain the original source IP while forwarding logs, without modifying the original log (to comply with legal requirements)? Log Integrity & Authenticity: Does NiFi ensure log integrity and authenticity for legal and compliance purposes? LEEF Parsing: Is there a NiFi processor available to parse LEEF logs before storing them in HDFS? thanks in advance   ... View more