IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  capture N/A value

    Posted 09/15/21 02:16 PM

    Hello,

    I need to tag events to a specific domain, I am using a custom property condition in the domain definition. This custom property will have some N/A values.

    How can I specify this in the domain tagging condition?

    How to say: if the custom property = N/A -> add to domain X?

    Thanks,

    Salma



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: capture N/A value

    Posted 09/15/21 04:58 PM

    Is it going to default?



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: capture N/A value

    Posted 09/16/21 06:38 AM

    Hello Salma,

    you can use a search in your rule condition to specify it. Same way as you would do it in a log search. Test "when the event matches this search filter".

    Martin



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: capture N/A value

    Posted 09/16/21 07:39 AM

    hello Support Member,

    yes, the events are going to default.

    I have tried using N/A and NULL but it didn't work! (of course it won't because the condition in the domain definition uses N/A and NULL as the content of the custom property)



    #QRadar
    #Support
    #SupportMigration


  • 5.  RE: capture N/A value

    Posted 09/16/21 07:42 AM

    hello Support Member,

    thanks for the suggestion, however in the domain tagging condition you can only specify the expected value and you can't use the search filter. It is only the equal condition that is used.

    Best,

    Salma



    #QRadar
    #Support
    #SupportMigration