IBM QRadar

 View Only

 Event Mapping issue

Jump to  Best Answer
Osama Ahmed's profile image
Osama Ahmed posted 12/24/24 04:27 AM

Hi All,

i want to change Event name and low level Category but when i go to DSM editor and type Event name in Custom field then show there is no event name property

Can you assist me for the Event name change and low level Category..

Snapshot is attached for clear Understanding

Regards,

Osama Ahmed

Attachment  View in library
Capture.PNG 4 KB
Karl Jaeger's profile image
Karl Jaeger IBM Champion posted 12/29/24 06:14 AM  Best Answer

Hi Osama

my guess is your logsource has been automatically created. Pls follow Susan's instructions.

use DSM editor learning videos in IBM academy and Jose links in YouTube if you haven't coded your own DSMs yet.

I have a step by step presentation available that I will make available via library in here in 2025.

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted 12/27/24 04:58 AM

Based on the image I am assuming you probably created a log source using Universal CEF type. Use DSM editor to create a custom log source type, change the type of the log source to what you created; then use DSM editor no your logs to create proper parsing for Event ID and Category, and to create and map the (unique) event IDs to new QIDs.

Osama Ahmed's profile image
Osama Ahmed posted 12/29/24 07:52 AM

Hellow  karl sir & dusan sir,

Hope you are both fine.

Issue has been Resolved with your recommendation step and helful guide.

Thanks for your swift response.

Regards,

Osama Ahmed

Related Content