Hi All,

I would like to know if somebody can help me achieve the following. I would like to add a custom property which uses AQL to refer to a table. I have added a table into QRadar that contains enriched data about my assets.

The table is in a format such as:

Key = Log Source Name
Value 1: Asset Type
Value 2: Criticality
etc..

I would like add a custom property which references where log source = X apply Value 1 = Criticality Custom Property.

This is just a rough example. I am just not sure how to structure the AQL to reference this table and pull that data.

Any help would be much appreciated.

Managed to resolve internally. :) ​

------------------------------
ryan Harvey
------------------------------

Original Message:
Sent: Thu February 20, 2020 12:47 AM
From: ryan Harvey
Subject: Creating a Custom Property using AQL

Hi All,

I would like to know if somebody can help me achieve the following. I would like to add a custom property which uses AQL to refer to a table. I have added a table into QRadar that contains enriched data about my assets.

The table is in a format such as:

Key = Log Source Name
Value 1: Asset Type
Value 2: Criticality
etc..

I would like add a custom property which references where log source = X apply Value 1 = Criticality Custom Property.

This is just a rough example. I am just not sure how to structure the AQL to reference this table and pull that data.

Any help would be much appreciated.

Hi Ryan, 

Can u describe how you've achieved that ...

Thanks,

Abhijeet

------------------------------
Abhijeet Potla
------------------------------

Original Message:
Sent: Thu February 20, 2020 01:33 AM
From: ryan Harvey
Subject: Creating a Custom Property using AQL

Managed to resolve internally. :) ​

------------------------------
ryan Harvey

Original Message:
Sent: Thu February 20, 2020 12:47 AM
From: ryan Harvey
Subject: Creating a Custom Property using AQL

Hi All,

I would like to know if somebody can help me achieve the following. I would like to add a custom property which uses AQL to refer to a table. I have added a table into QRadar that contains enriched data about my assets.

The table is in a format such as:

Key = Log Source Name
Value 1: Asset Type
Value 2: Criticality
etc..

I would like add a custom property which references where log source = X apply Value 1 = Criticality Custom Property.

This is just a rough example. I am just not sure how to structure the AQL to reference this table and pull that data.

Any help would be much appreciated.