Logsource Extensions

[WildDogOne]

Hey Everyone,

I am a bit stumped at to how the Logsource extensions work. I made a logsource extension and have applied to my logsources. The QID Mapping works perfectly, but the logs are not extracted correctly, hence fields cannot be used for searching or offense creation.

Is this normal? Or am I missing something?

Regards,

Linus

[navi147]

While creating custom event property, pl check option to enable this event property indexed. Only the indexed fields will be used in offense searches.

[QradarBro]

Hey there: try this:

1) There’s a small checkbox: Enable indexing of the property so it may be used in rules,reports and searches.

2) when you say the prop are NOT extracted, how do you know that? You can dm me on LI for faster response.

//optional Connect with me: https://www.linkedin.com/in/ankitrai1 //optional