IBM Security Guardium

Hello,

I have a Policy built under the Access Type of Policy.  I have a  Rule where I am matching on traffic that meets certain parameter. I am sending those alerts through Sys Log to our SIEM tool (Qradar).  I have created a template with the below fields in the Global Profile.  The only field I am having trouble with is the "Object Name" field.  I have it set up like this:  "Object Name=%%ObjectName"   It does not work.  I am being told that Object Name can't be sent in a template to Syslog.  Has anyone had any luck sending the Object Name field to the Sys Log in a template?  Not sure why it would be the only field that does not work??

LEEF:1.0|IBM|Guardium|10.0|%%ruleDescription|ruleID=%%ruleID|ruleDesc=%%ruleDescription|severity=%%severity|devTime=%%receiptTime|serverType=%%serverType|classification=%%classification|category=%%category|dbProtocolVersion=%%DBProtocolVersion|usrName=%%AppUserName|sourceProgram=%%SourceProgram|start=%%sessionStartMills|dbUser=%%DBUser|dst=%%serverIP|dstPort=%%serverPort|src=%%clientIP|srcPort=%%clientPort|protocol=%%netProtocol|type=%%requestType|violationID=%%violationID|sql=%%SQLString|error=%%lastError|Database name=%%DBName|Object Name=%%ObjectName

Brian Greenwood CPC HCISSP-A

Information Security Analyst II

Arkansas Blue Cross and Blue Shield

515 Pershing Blvd

North Little Rock, Arkansas 72214

Office | 501-210-4319

Hello,

I have a Policy built under the Access Type of Policy.  I have a  Rule where I am matching on traffic that meets certain parameter. I am sending those alerts through Sys Log to our SIEM tool (Qradar).  I have created a template with the below fields in the Global Profile.  The only field I am having trouble with is the "Object Name" field.  I have it set up like this:  "Object Name=%%ObjectName"   It does not work.  I am being told that Object Name can't be sent in a template to Syslog.  Has anyone had any luck sending the Object Name field to the Sys Log in a template?  Not sure why it would be the only field that does not work??

LEEF:1.0|IBM|Guardium|10.0|%%ruleDescription|ruleID=%%ruleID|ruleDesc=%%ruleDescription|severity=%%severity|devTime=%%receiptTime|serverType=%%serverType|classification=%%classification|category=%%category|dbProtocolVersion=%%DBProtocolVersion|usrName=%%AppUserName|sourceProgram=%%SourceProgram|start=%%sessionStartMills|dbUser=%%DBUser|dst=%%serverIP|dstPort=%%serverPort|src=%%clientIP|srcPort=%%clientPort|protocol=%%netProtocol|type=%%requestType|violationID=%%violationID|sql=%%SQLString|error=%%lastError|Database name=%%DBName|Object Name=%%ObjectName

Brian Greenwood CPC HCISSP-A

Information Security Analyst II

Arkansas Blue Cross and Blue Shield

515 Pershing Blvd

North Little Rock, Arkansas 72214

Office | 501-210-4319