Global Security Forum

 View Only

 QRadar – Visibility of CRE Events for users with restricted Security Profile

Michail Christof's profile image
Michail Christof posted Fri February 06, 2026 06:59 AM

Hello everyone,

I am looking for guidance on how to make CRE (Custom Rule Engine) generated events visible to customer users in IBM QRadar.

We have CRE rules that are successfully generating events and offenses. The challenge is ensuring that these CRE-generated events are visible to a customer user who has:

  • a restricted Security Profile (limited to specific log sources / networks / domain)

  • a read-only role (Log Activity / Offense Viewer)

  • access limited strictly to their own data (multi-tenant environment)

The goal is to allow customer users to view events produced by CRE rules, without granting them permissions to manage or modify rules.

Any insights or real-world experience would be greatly appreciated.

Thanks in advance!

Perf1's profile image
Perf1 posted Mon February 09, 2026 06:24 PM

It is certainly possible to allow a user view CRE events without granting permission to manage or modify rules. Just add the CRE log source(s) to the Security Profile.
However, it will allow such user to see all CRE events, which is likely not what you want.

To have a user only see CRE events from a certain limited list of rules and without granting permission to manage or modify rules is generally impossible AFAIK.

Michail Christof's profile image
Michail Christof posted Wed February 11, 2026 04:18 AM

Thank you for your response.

No it is not  what I want but, I tried to assign the CRE log source, but I received the following error:

"The following selected log sources are not associated with selected domains: Custom Rule Engine"

Juan Paulo's profile image
Juan Paulo posted Thu February 12, 2026 11:03 AM

Hi Michail, I don't have a multi-tenat QRadar SIEM available so I can't try excatly what I'm wrinting here.

What I do remember it's that you CAN at the domain configuration level, select which data it's part of a Domain, not only by selecting the log source, but only part of the data of a log source based on "Custom Properties".

Not sure if that will satisfied you requirement, but you could give it a try.

Just in case you may also upload your requirement to the IDEAS portal where the Product managers can review it an add it into the product:
https://ideas.ibm.com/products/7003354097537438773

best regards

best regards

Related Content