Dear Community,
I have a log source that sends urls to QRadar. Those urls contain a query part, i.e.
https://example.com/resource?id=1234.
Messages are forwarded to QRadar via Syslog in CEF-Format. The equals sign has a special meaning in CEF (key-value-separator). Therefore the CEF-forwarder escapes them with a backslash. The resulting string would be
https://example.com/resource?id\=1234.
In my custom DSM I do capture the string via regex and assign it (including the backslash) to a custom propery. How can I achieve to remove the backslash from the property value?
Many thanks in advance for your help.
Nils