QRadar 101

Resolves an issue where AlertInfo events categorized as ‘Stored’ when the payload contains ‘Title:’ in front of the event message. The change allows events to successfully parse, but some Microsoft Defender can still categorize as unknown when alerts are sent from outside services to Microsoft Defender. To further assist users with confusion around unsupported service events, an enhancement to the event category now displays outside source names as ‘Unknown [Service Source] Alert’, such as ‘Unknown Microsoft Cloud App Security Alert’. Administrators who experience events from outside services must map these unknown events in the DSM Editor.

Resolves multiple issues in the Linux OS DSM: 1. Added parsing support for authentication events that can be sent with a new event format. 2. Updated parsing performance for authentication failure events. 3. Enhanced the Linux OS DSM to add parsing support for system-d core dump events. 4. Resolves an issue where username values that include curly brackets, such as ‘${username’ did not capture the full username, only the dollar-sign value. 5. An event parsing dependency exists between the Linux OS DSM RPM and DSM Common. If you manually install RPM files from IBM Fix Central, you must install the latest version of DSM Common on the Console appliance, then install the Linux OS DSM.

Resolves multiple issues in the Palo Alto Networks PA Series DSM: 1. Resolves an issue where the DSM can parse events as ‘Stored’ when they contained x7c in the LEEF payload. 2. Enhanced the DSM to add a category for unknown PA Series Threat events, such as ‘Unknown PA Series Threat – Spyware’. The purpose of this change is to identify and differentiate between Palo Alto unknown threat events and events where the DSM parses and sets the EventID value as unknown. 3. Enhanced the parsing for ‘PA Series Threat’ events to ensure the DSM successfully parses events and assigns categories when the thread_ID value is not provided in brackets in the payload.

Resolved an issue in the Cisco CatOS for Catalyst Switches DSM to properly capture usernames encapsulated in single quotes.

Enhanced the DSM Common framework with several updates: 1. Support changes in the Linux OS DSM for authentication event format changes, parsing performance improvements, and username parsing patterns. 2. Support parsing changes in the Palo Alto PA Series DSM. Note: A parsing dependency exists between the Linux OS and Palo Alto PA Series DSM and the DSM Common framework. If you manually install RPM files from IBM Fix Central, you must install the latest version of DSM Common on the Console appliance, then install the Linux OS DSM to ensure all parsing changes are applied.