I have a log source that provides username in a format that is not recognized by QRadar, I can create a custom event property to match it but I cant find the way to use this property as Username for this log source, what I want to do is to replace the username property for this log source for the one I have created. If it is not posible, is it posible to modify the default Username property to add a custom expression to match?

Thanks in advanced

------------------------------
A CG
------------------------------

Hello, CEP cannot be used as Username with the way to define CEP.  If you want to use the property as Username, please use DSM Editor and modify the Username format with your expression.

------------------------------
BYUNG JUN NA
------------------------------

It is my understanding that it should be possible to do it through DSM editor; this should result in an LSX automatically added as parsing enhancement to the log source. (Make sure it is done using representative set of logs while creating new regex for this).
However, is this a standard log source type or not? If yes, it should be maybe further analyzed why is this happening (e.g. is there an identified issue and/or a DSM update that could help)?

------------------------------
Dusan VIDOVIC
------------------------------

It's a standard log source (Microsoft Windows Security Event Log), the problem is that for some events the username it's recognized correctly, but for some others not (some logs from Active Directory for example). I don't want to change the username property for the entire log source, so I want to use a custom property for some QIDs. As far as I know, if I change the username property in the DSM it will change for all events of the log source, I can't choose specific QIDs, not?

------------------------------
A CG
------------------------------

Original Message:
Sent: Mon May 13, 2019 06:32 AM
From: Dusan VIDOVIC
Subject: Replace or modify Username default property in Qradar

It is my understanding that it should be possible to do it through DSM editor; this should result in an LSX automatically added as parsing enhancement to the log source. (Make sure it is done using representative set of logs while creating new regex for this).
However, is this a standard log source type or not? If yes, it should be maybe further analyzed why is this happening (e.g. is there an identified issue and/or a DSM update that could help)?

------------------------------
Dusan VIDOVIC
------------------------------

Ah, we are also in a similar situation where in a sysmon log source username is being parsed as domain\username format. This is creating new users under the UBA, i did try to play with the LDAP attribute mapping but it does not seem to support this kind of format. May be someone from the team can shed more light on this situation.

------------------------------
Arjun Kumar Network & Security Engineer
------------------------------

Original Message:
Sent: Tue May 14, 2019 04:38 AM
From: A CG
Subject: Replace or modify Username default property in Qradar

It's a standard log source (Microsoft Windows Security Event Log), the problem is that for some events the username it's recognized correctly, but for some others not (some logs from Active Directory for example). I don't want to change the username property for the entire log source, so I want to use a custom property for some QIDs. As far as I know, if I change the username property in the DSM it will change for all events of the log source, I can't choose specific QIDs, not?

------------------------------
A CG
------------------------------


Original Message:
Sent: Mon May 13, 2019 06:32 AM
From: Dusan VIDOVIC
Subject: Replace or modify Username default property in Qradar

It is my understanding that it should be possible to do it through DSM editor; this should result in an LSX automatically added as parsing enhancement to the log source. (Make sure it is done using representative set of logs while creating new regex for this).
However, is this a standard log source type or not? If yes, it should be maybe further analyzed why is this happening (e.g. is there an identified issue and/or a DSM update that could help)?

------------------------------
Dusan VIDOVIC

I think that it will be very usefull to have some way to do a custom map to Username property for specific events, not for all log source events, specially for UBA, because UBA only works with the Username property and, as far as I know, it's no possible to provide to UBA information from a user using another property. Could someone from the team tell us if there is any way to do this? Thanks in advanced.

------------------------------
A CG
------------------------------

Original Message:
Sent: Tue May 14, 2019 04:04 PM
From: Arjun Kumar
Subject: Replace or modify Username default property in Qradar

Ah, we are also in a similar situation where in a sysmon log source username is being parsed as domain\username format. This is creating new users under the UBA, i did try to play with the LDAP attribute mapping but it does not seem to support this kind of format. May be someone from the team can shed more light on this situation.

------------------------------
Arjun Kumar Network & Security Engineer
------------------------------


Original Message:
Sent: Tue May 14, 2019 04:38 AM
From: A CG
Subject: Replace or modify Username default property in Qradar

It's a standard log source (Microsoft Windows Security Event Log), the problem is that for some events the username it's recognized correctly, but for some others not (some logs from Active Directory for example). I don't want to change the username property for the entire log source, so I want to use a custom property for some QIDs. As far as I know, if I change the username property in the DSM it will change for all events of the log source, I can't choose specific QIDs, not?

------------------------------
A CG


Original Message:
Sent: Mon May 13, 2019 06:32 AM
From: Dusan VIDOVIC
Subject: Replace or modify Username default property in Qradar

It is my understanding that it should be possible to do it through DSM editor; this should result in an LSX automatically added as parsing enhancement to the log source. (Make sure it is done using representative set of logs while creating new regex for this).
However, is this a standard log source type or not? If yes, it should be maybe further analyzed why is this happening (e.g. is there an identified issue and/or a DSM update that could help)?

------------------------------
Dusan VIDOVIC

Hey there
Have a look at this thread from developers. 

https://developer.ibm.com/answers/questions/504317/replace-or-modify-username-default-property-in-qra/

T&R

------------------------------
Arjun Kumar Network & Security Engineer
------------------------------