Hi,

we recently discovered that some event properties of a log source were N/A although the payload contained the relevant data and the DSM editor showed that it would extract them. The DSM was built for a CEF-sending log source, using the CEF expression type.

We found the following:

* the issue only popped up with payload values containing escaped backslashes

* the DSM editor showed the extracted CEF value, but unescaped the backslashes when presenting

* the fix for us was to use the Regex expression type instead

Anyone else seeing this or did we miss a DSM update? Currently running QRadar 7.50 UpdatePackage 2 + IF01.

I think you should get a case opened for this issue. We've seen this specific problem on custom properties created in the DSM Editor in the past for JSON events. This was addressed in 7.5.0 in APAR IJ16423.

However, I cannot find anything logged that is specific to backslashes in CEF payloads. This change is likely required in the DSM Editor itself. When users reported that backslash characters in JSON were not parsing as expected, the change was added in the DSM Editor code, not the DSM itself.

I would open a case with support so we can review this issue and confirm if it needs to be logged for development.