Overview

This component provides a direct and secure channel for transmitting OutSystems-generated events to IBM QRadar SIEM, ensuring visibility of critical logs within enterprise-wide monitoring dashboards. The extension is ideal for security and compliance teams that need encrypted log forwarding from OutSystems Cloud or on-prem installations to QRadar.

Core Capabilities

1. SendOneTLS
   Establishes a secure Syslog/TLS session and transmits a single LEEF 2.0 event to QRadar’s collector (default port 6514).

   • Inputs: Host, Port, Message, ConnectTimeoutMs, SendTimeoutMs.

   • Output: Text result (“OK” or error detail).

   • Implements RFC 5425 framing and UTF-8 encoding.

2. DiagnoseTlsConnect
   Performs DNS resolution, TCP connect, and TLS handshake validation to verify network reachability and certificate trust. Returns detailed diagnostic text for troubleshooting firewall or certificate issues.

Message Format

Events must follow LEEF 2.0 conventions, for example:

LEEF:2.0|Damco|DamcoWorks|1.0.0|user.login|sev=5    msg=Login success    user=jdoe    app=DamcoWorks

Benefits

• Seamless integration between OutSystems and QRadar SIEM.

• Secure end-to-end encrypted log transmission.

• Helps meet audit, SOC 2, and ISO 27001 compliance requirements.

• Enables centralized correlation of application-level and infrastructure logs.

• Lightweight, no external proxy or third-party dependency.

Requirements

• Network access from OutSystems runtime to QRadar’s Syslog TLS endpoint (6514).

• QRadar log source configured to accept LEEF format over TLS.

Typical Use Cases

• Forwarding application, integration, or authentication events to SIEM.

• Real-time anomaly or threat detection from OutSystems activity.

• Unified compliance reporting and centralized audit logging.