Creating a log source extensions document to get data into QRadar

When to create a log source extension

For log sources that don't have an official DSM, use a custom log source type to integrate log sources. A log source extension (also known as a device extension) is then applied to the custom log source type to provide the logic for parsing the logs. The LSX is based on Java™ regular expressions and can be used against any protocol type, such as syslog, JDBC, and Log File. Values can be extracted from the logs and mapped to all common fields within IBM® QRadar®.

When you use log source extensions to repair missing or incorrect content, any new events that are produced by the log source extensions are associated to the log source that failed to parse the original payload. Creating an extension prevents unknown or uncategorized events from being stored as unknown in QRadar.

Using the DSM Editor to quickly create a log source extension

For IBM QRadar V7.2.8 and later, you can use the DSM Editor to create log source extensions. The DSM Editor provides real-time feedback so that you know whether the log source extension that you are creating has problems. Use the DSM Editor to extract fields, define custom properties, categorize events, define new QID definitions, and define your own log source type. For more information about the DSM Editor, see the IBM QRadar Administration Guide.

Process for manually creating a log source extension

Alternatively, to manually create a log source extension, complete the following steps:

1. Ensure that a log source is created in QRadar.

   Use a custom log source type to collect events from a source when the log source type is not listed as a QRadar supported DSM.

   Use the DSM Editor to create the new log source type, and then manually create the log source. You can attach an LSX to a supported log source type, such as Windows, Bluecoat, Cisco, and others that are listed as QRadar supported DSMs.

2. To determine what fields are available, use the Log Activity tab to export the logs for evaluation.
3. Use the extension document example template to determine the fields that you can use.

   It is not necessary to use all of the fields in the template. Determine the values in the log source that can be mapped to the fields in extension document template.

4. Remove any unused fields and their corresponding Pattern IDs from the log source extension document.
5. Upload the extension document and apply the extension to the log source.
6. Map the events to their equivalents in the QIDmap.

   This manual action on the Log Activity tab is used to map unknown log source events to known QRadar events so that they can be categorized and processed.