IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

SQL Table Custom fields parsing problem

  • 1.  SQL Table Custom fields parsing problem

    Posted Fri September 27, 2019 02:42 AM
      |   view attached

    Hello

    I am testing QRadar with my customer .My customer logs SQL audit logs into SQL table,this table has custom fields



    QRadar cannot parse these custom fields.I can manually edit SQL DSM editor and create custom fields in DSM but if my customer in the future will add other fields in the SQL table this problem will occur again.

     

    so what is the best solution in this situation, what can I do?

     

    thank you and sorry for my bad English :))



    ------------------------------
    Sicnerely,
    Davit Ubilava
    ------------------------------


  • 2.  RE: SQL Table Custom fields parsing problem

    Posted Mon September 30, 2019 08:47 AM
    Hi Davit, of cause you can not predict all the possible future changes to this SQL table. My opinion is that if you think such changes are really possible, then it's better to create a view based on all the fields you need and poll it with QRadar. In this case, if customer changes the table in question you still have your ad-hoc view intact.