Configuring QRadar® for users to use OP code instead of connection number

By default, Open LDAP events are combined on the operation code. If you want to change the way that IBM QRadar maps events, you can use the DSM Editor to combine events on connection number.

Procedure

  1. Click the Admin tab.
  2. In the Data Sources section, click DSM Editor.
  3. From the Select Log Source Type window, select Open LDAP Software from the list, and click Select.
  4. On the Configuration tab, set Display DSM Parameters Configuration to on.
  5. From the Event Collector list, select the event collector for the log source.
  6. Set Allow User to use OP code rather than Connection number to on.
  7. Click Save and close out the DSM Editor.