IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Event Rule Wizard: Reference Table Key test usage

  • 1.  Event Rule Wizard: Reference Table Key test usage

    Posted Wed December 23, 2020 08:10 AM
    Edited by Ali Okan Yuksel Wed December 23, 2020 11:39 AM

    Hello

    I want to use "when Reference Table Key data matches any|all selected event properties and selected reference table column Select operator the value of selected event property" test in my event rule. But when I clicked to "Reference Table ", I cannot see my reference table on the list.

    The purpose of the test is checking  if username exists in my reference table. My reference table is regularly updated by "Reference Data Import - LDAP" app.

    I checked reference table creation api interface. But I couldn't see any detail about "Primary Key" definition in rest api form.

    Screenshots attached.

    Should I define a primary key for reference table? How can I solve it? Or do you have another suggestion for using "Reference table" data in test rules?



    ------------------------------
    Ali Okan Yuksel
    ------------------------------