IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Problem with Mapping Events

    Posted Thu December 17, 2020 07:58 AM

    Hi team,

    I have discovered that at some events, event mapping is not applied at Universal DSM. We have compared mapped and unmapped events, there was no difference. 

    Also, map event button is not clickable on those events. We are not allowed to change the DSM of the log source.

    Do you have any solution of these problems? Did you encountered this kind of trouble?

    Thank you in advance for your opinion.

    Regards.



    ------------------------------
    Halil BALIM
    ------------------------------


  • 2.  RE: Problem with Mapping Events

    Posted Thu December 17, 2020 10:33 AM

    Halil,

    this is normal QRadar behaviour. Events are always the same and stay unmodified. However they are processed depending on their logsource definition. This depends on if the logsource was autodetected or not. Mapping of events-ids to QIDs is based on there categorization (Event-ID/LLC/HLC) by the DSM assigned. If an event gets grabbed by Universal DSM (aka "stored") categorization is "unknown". 1st thing to do is adding a logsource for the datasource if its not created automatically by QRadar. Stored events processed by Universal DSM cannot be mapped via QIDmap dialogue by design. However if you assign a DSM of your own. If doing so, you are able to run the QIDmap function and it will be enabled on those events being not yet categorized. An alternative is to use DSMedit to program a DSM that for your own events. Why are you not allowed to change the Universal DSM to anything meaningful? Are you using Universal DSM togehter with LSX? I so you can extend it on order to map your event IDs. If not please explain if your admin rights are limited.

    BR, Karl



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: Problem with Mapping Events

    Posted Thu December 17, 2020 11:26 AM

    Hi Karl, 

    I think some parts of my message is missing. Let me clarify myself.

    I have added 2 jdbc log source on my QRadar as Universal DSM log source type. They are both have the same type of event style. I have parsed the event id from dsm editor for both. While one Log Source's all events mapped, the other log source's events are not mapped at 1/10 rate. I mean, at the second log source we see almost 1800 events mapped, but 200 events are seen as Universal DSM Message.

    By the way, I mapped all events to one custom event, for your information.

    Regards. 



    ------------------------------
    Halil BALIM
    ------------------------------



  • 4.  RE: Problem with Mapping Events

    Posted Fri December 18, 2020 03:36 AM

    Halil, thanks for the explanations. If your events doesn't get mapped correctly there are unknown stored events left not being mapped to your eventID. It's a bit tricky to grab those in dsmedit. One way is to export payload Of those events and reinject Events using logrun.pl from command shell. You can use qidmap dialogue for mapping as an alternative to dsmedit. Don't try to map stored events cause those can't be mapped once Qradar Universal DSM grabbed them as outlined before. Pls double check if logsource is correct cause both logsource using Universal DSM plus QRadar is using same DSM for unknown stored events. Double check all categories. The events tobe mapped are unknown/unknown/unknown type. 
    BR Karl 



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------