Global Security Forum

It is certainly possible to allow a user view CRE events without granting permission to manage or modify rules. Just add the CRE log source(s) to the Security Profile.
However, it will allow such user to see all CRE events, which is likely not what you want.

To have a user only see CRE events from a certain limited list of rules and without granting permission to manage or modify rules is generally impossible AFAIK.

Thank you for your response.

No it is not  what I want but, I tried to assign the CRE log source, but I received the following error:

"The following selected log sources are not associated with selected domains: Custom Rule Engine"

Hi Michail, I don't have a multi-tenat QRadar SIEM available so I can't try excatly what I'm wrinting here.

What I do remember it's that you CAN at the domain configuration level, select which data it's part of a Domain, not only by selecting the log source, but only part of the data of a log source based on "Custom Properties".

Not sure if that will satisfied you requirement, but you could give it a try.

Just in case you may also upload your requirement to the IDEAS portal where the Product managers can review it an add it into the product:
https://ideas.ibm.com/products/7003354097537438773

best regards

best regards

Hi Michail,

That is an expected behavior in a domain-restricted QRadar environment.

CRE-generated events use the Custom Rule Engine log source, but those events are not treated the same way as normal external log source events. In IBM’s domain model, users only see data inside the domains assigned through their Security Profile, and domain restrictions take priority over other log source permissions.

The error means the Custom Rule Engine log source is not associated with the selected domain, so QRadar won’t allow it to be added to that restricted Security Profile. IBM also notes that CRE-generated events are not assigned domains through custom event properties because they are not parsed as events from external log sources.

So practically:

Adding the CRE log source may expose all CRE-generated events, not only the customer’s rules.

Filtering CRE visibility per tenant or per limited rule set is generally not supported cleanly through read-only permissions alone.

For multi-tenant use, the safer design is to ensure the offenses and original source events are domain-tagged correctly, then let customers view those through their restricted domain/security profile.

I would not grant broad CRE log source access unless you’re comfortable with cross-tenant visibility risk.