IBM Security QRadar

 View Only
  • 1.  Custom event property

    Posted Fri July 12, 2019 01:14 PM
    Hi
    I would like to know how can i show a custom event property that i created in the event informacion pane of a event
    Thanks for the help

    ------------------------------
    Johan López
    ------------------------------


  • 2.  RE: Custom event property

    Posted Wed July 24, 2019 09:38 AM
    Hi Johan,

    I assume you are wanting to add your field to the search results in the log activity tab correct?   If this is indeed the case you can initiate a search or in the log activity tab in the upper left hand corner click on search  "new Search"  or if you have a search already "Edit Search".  Once there scroll down  a short way to "Column Definition"  your custom field should show up in the list on the left side, select it and move it to the right side.  Once it is there you can adjust where it shows up in the search.

    ------------------------------
    Ray Meanrd
    Sr. Security Architect
    IBM
    -
    ------------------------------



  • 3.  RE: Custom event property

    Posted Thu July 25, 2019 10:03 AM
    When you click on an event you get the event detail, and any custom properties should display along with the normal properties. If not be sure the event is for the correct log source DSM, that is, the one that you modified. You can go back to event grid listing, select it, then use Actions/DSM editor to view the event properties as they are being parsed, and make any updates there as well.

    ------------------------------
    James Hewitt
    QRadar SIEM admin
    Dish
    ------------------------------