Creating a pattern filter on the SAP server

A Pattern Filter is a user configured setting that can be used to limit queries to specific events. When a Pattern Filter is generated on the SAP server, a Filter Id is provided. The Filter Id can then be entered into the Pattern Filter Id field of the QRadar® log source to filter the patterns that are retrieved.

1. To create the Pattern Filter on the SAP Server, use the following steps:
   1. Log in into the SAP server by using the administrator user name and password.
   2. Go to Administration > Settings.
   3. Select Pattern Filter and click Add.
   4. Enter a name for the Pattern Filter. This name is only used for identification purposes.
      Note: The name appears in the Name Column with a corresponding Filter Id (UUID). Record the Filter Id for future reference.
   5. Click the pattern filter name to see a new table with Namespace as a column header.
   6. To add patterns to the Pattern Filter, click Add.
      Note: A new window appears called Pattern.
   7. Select any Pattern you want to filter on and click OK.
   8. Refresh the page and ensure that the Pattern was added to the table with the Namespace header.
2. To use a Pattern Filter with QRadar, use the following steps:
   1. Either select or create an SAP ETD Alert API log source.
   2. Find the Use Pattern Filter Id check box and select it.
   3. Enter the Filter Id obtained in step 1d and enter it in the Patter Filter Id field.
   4. Save the log source.
      Note: If you receive a 500 Internal Server Error after you save the log source with the Filter Id, double check that there is at least one pattern that is being filtered for.