Hello all,
I am integrating MS cloud app security with QRadar and used universal DSM and cloud REST api. I am getting the logs in QRadar but they are not parsed. I tried to parse them in DSM editor and successfully parsed most of those logs. The problem is when I open events in DSM editor, I can see all my custom extracted properties there but when I open event in log activity, my custom extracted properties don't show up there. What should I do to see custom properties in log activity events.

Thanks in Advance,

------------------------------
Abdul Rahman
------------------------------

Anyone who can guide, please?

------------------------------
Abdul Rahman
------------------------------

Original Message:
Sent: Wed August 04, 2021 12:00 PM
From: Abdul Rahman
Subject: Universal DSM parsing error

Hello all,
I am integrating MS cloud app security with QRadar and used universal DSM and cloud REST api. I am getting the logs in QRadar but they are not parsed. I tried to parse them in DSM editor and successfully parsed most of those logs. The problem is when I open events in DSM editor, I can see all my custom extracted properties there but when I open event in log activity, my custom extracted properties don't show up there. What should I do to see custom properties in log activity events.

Thanks in Advance,

------------------------------
Abdul Rahman
------------------------------

------------------------------

Also, could be that ur EventID not parsed yet

------------------------------
Mohd Mukrim Che Mohamad Zulkifly
------------------------------

Original Message:
Sent: Thu August 05, 2021 05:44 AM
From: Abdul Rahman
Subject: Universal DSM parsing error

Anyone who can guide, please?

------------------------------
Abdul Rahman

Original Message:
Sent: Wed August 04, 2021 12:00 PM
From: Abdul Rahman
Subject: Universal DSM parsing error

Hello all,
I am integrating MS cloud app security with QRadar and used universal DSM and cloud REST api. I am getting the logs in QRadar but they are not parsed. I tried to parse them in DSM editor and successfully parsed most of those logs. The problem is when I open events in DSM editor, I can see all my custom extracted properties there but when I open event in log activity, my custom extracted properties don't show up there. What should I do to see custom properties in log activity events.

Thanks in Advance,

------------------------------
Abdul Rahman
------------------------------