IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Object Name in LEEF Sys Log

    Posted 05/27/21 09:41 AM
    Edited by Brian Greenwood 11/19/24 03:58 PM

    Hello,

     

    We are really needing the Object Name field added into the LEEF template to send by SYS LOG to Qradar (our log monitoring tool).  However, it doesn't seem that Object is an option to add to LEEF.  I have tried this and looked for documentation. I just want to see if there is anything possible here to add the Object field to the LEEF template.

     

    Brian Greenwood CPC HCISPP-A

    Information Security Analyst II



  • 2.  RE: Object Name in LEEF Sys Log

    Posted 05/28/21 02:42 AM

    Hi,
    You can modify event content.

    Here list of available variables:

    The alert message template

    Ibm remove preview
    The alert message template
    Message templates determine the content of alerts. You can create multiple message templates from the Global Profile, and use them with different rules as required.
    View this on Ibm >

    In you case you should add %%Object

    It is a array because one SQL can touch many objects.

    The cli command "store alert_object_num_limit" defines how maximum number of objects extracted to array.



    ------------------------------
    Zbigniew (Zibi) Szmigiero
    IBM
    ------------------------------



Related Content