Question & Answer
Question
Why are my custom properties not showing up in rules, routing rules, reports, and searches?
Cause
The option "Enable for use in Rules, Forwarding Profiles and Search Indexing" was not selected when the custom property was created.
For Rules only: The custom property must be defined for the record type that the rule is testing against. Event Rules can use only Custom Event Properties, Flow Rules can use only Custom Flow Properties, and Common Rules use only normalized properties that exist as both as Custom Event Property and Custom Flow Property. If the rule is configured to be a Common Rule, user-generated custom properties are not available for use.
Answer
To resolve this issue:
- Go to the QRadar UI.
- In the Admin tab under Data Sources, open Custom Event Properties.
- Select the Custom Property that you are having issues with and edit it.
- In Custom Event Properties under the Property Definition section, ensure that check box for Enable for use in Rules, Forwarding Profiles and Search Indexing is selected.
Example
- Click Save. Note: There is no need to Deploy Changes.
Results
The custom property is available to for use from the custom property list
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtrAAA","label":"Rules"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]
Historical Number
1585
Was this topic helpful?
Document Information
Modified date:
10 November 2023
UID
swg21622236