Any thoughts on recommended logs that should be sent to QRADAR SIEM ?  what subscriptions should be configured ? 

Hello all  i have created an event stream and configured the queue on siem to collect events. i was able to verify that events are being collected using Ruby tool. Also on my eventcollector i was able to see communication with cisco AMP on tcpdump.  ...