IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Enable automatically disabled CEP

    Posted Wed July 12, 2023 02:12 PM

    Hello, 

    CEP is randomly disabled daily in our Qradar (CEP have been tuned and we known that they to be disabled due to performance issues). 
    IBM support cannot review/do developments, so if someone has developed something similar please give us some advice. 
    I have identified the postgres's tables that store the CEP and I think it would be to update the modification date and status from 'f' to 't' for those CEP's that are disabled during the day, for that we would have to orchestrate a process that runs periodically every 5 or 10 minutes. 
    We should also see the dependencies of those tables in the data model to avoid problems.
    Postgres's Tables:
     
    -ariel_property_expression
    -ariel_property_json_expres
    -ariel_property_leef_expres
    -ariel_property_cef_express
    -ariel_property_aql_express
     
    Columns to update:
    Columnas:  enabled = 'f' y editdate = now()
    Thank you in advance
     
    Regards 


    ------------------------------
    Nelba Sanchez
    ------------------------------


  • 2.  RE: Enable automatically disabled CEP

    Posted Mon March 11, 2024 08:52 AM

    Hello Nelba,

    Could you please help me with the  exact file which need to be modified ?

    Regards,

    Madesh



    ------------------------------
    Madesh Waran
    ------------------------------

    Original Message


  • 3.  RE: Enable automatically disabled CEP

    Posted Mon March 11, 2024 09:11 AM

    The custom properties can be re-enabled from the Admin tab. There is no need to modify the database tables when you receive the system notification. I would recommend that you contact support, if you are experiencing issues with custom properties being disabled. We likely want to review this appliance to confirm which properties need tuning. 



    ------------------------------
    Jonathan Pechta
    IBM Security - Community of Practice Lead
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message


  • 4.  RE: Enable automatically disabled CEP

    Posted Tue March 12, 2024 09:53 AM

    Thanks Madesh and Jonathan,

    Finally, we use APIs to enable CEP that are continually disabled due to performance issues.



    ------------------------------
    Nelba Sanchez
    ------------------------------

    Original Message


Related Content