IBM Security QRadar

 View Only

  • 1.  json keypath expression not working in qradar 7.4.0

    Posted Wed May 27, 2020 11:31 AM
    Hello all,

    I'm trying to use the example from:
    https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/c_qradar_adm_dsm_ed_json_keypath.html

    In the attached image one can see that the properties "first_name" and "last_name" are getting highlighted as described on IBM Knowledge Center.

    However, by pressing the OK button it says: "The value entered is not a valid expression."

    Any ideas? Suggestions?

    Thank you,
    Stefan

    ------------------------------
    Stefan Haunß
    ------------------------------


  • 2.  RE: json keypath expression not working in qradar 7.4.0

    Posted Wed May 27, 2020 11:32 AM
      |   view attached
    forgot to upload the attachment

    ------------------------------
    Stefan Haunß
    ------------------------------

    Original Message


  • 3.  RE: json keypath expression not working in qradar 7.4.0

    Posted Sun June 14, 2020 04:26 AM
    Hello,

    Here in this case seems like you are forwarding log as syslog format in which it has  JSON embedded, however parser works only on entire log. So it cannot understand as its JSON. 

    Incase if you want to use JSON, try changing at source to forward as JSON and should work there by.

    Regards,
    Venky

    ------------------------------
    Venkatesh Siddi
    ------------------------------

    Original Message


  • 4.  RE: json keypath expression not working in qradar 7.4.0

    Posted Mon June 15, 2020 12:16 PM
    Hi Venkatesh,

    This is actually incorrect. The JSON parser will scan through the event payload to find the beginning of a JSON object (if one is present)and start working from there. It's fine to include a JSON object in a syslog message.

    Cheers
    Colin

    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------

    Original Message


  • 5.  RE: json keypath expression not working in qradar 7.4.0

    Posted Mon June 15, 2020 12:14 PM
    Hi Stefan,

    This isn't working because you are attempting to combine multiple captured values for a custom property. We do allow multiple references to be combined together (along with literal characters, if desired) for standard properties, like Username, but it's not currently possible to do this with custom properties like AccountDomain. We are working on a product enhancement to allow for this in custom properties too, but it is not yet available.

    FYI, this is what the document is referring to when it says this: "Within log source extensions, you can supply and combine together multiple JSON keypaths to give a single result; this convention excludes custom properties"

    Note that it is possible to combine multiple extraction property values together with a custom AQL property, if this is something you need to do.

    Cheers
    Colin

    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------

    Original Message


  • 6.  RE: json keypath expression not working in qradar 7.4.0

    Posted Wed April 21, 2021 12:45 PM
    Hi @COLIN HAY, is it still not available to combine multiple captured values for a custom property​ ?

    ------------------------------
    Erez Avram
    ------------------------------

    Original Message


  • 7.  RE: json keypath expression not working in qradar 7.4.0

    Posted Wed April 21, 2021 01:12 PM
    Hi Erez,

    This is still not available for extraction type custom properties, you would need to use an AQL property to combine multiple extraction properties

    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------

    Original Message