IBM Security Privileged Session Recorder
Use the IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties to closely monitor your IBM Security Privileged Session Recorder deployment.
Important: To avoid content errors in this content extension, keep the associated DSMs
up to date. DSMs are updated as a part of the automatic updates. If automatic updates are not
enabled, download the most recent version of the associated DSMs from IBM® Fix Central (https://www.ibm.com/support/fixcentral).
IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.1
The following table shows the custom properties in IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.1.
| Name | Optimized | Capture Group | Regex |
|---|---|---|---|
| Resource Name | Yes | 1 | REMOTEHOST: "(.+?)" |
IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.0
The following table shows the custom properties in IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.0.
| Name | Optimized | Capture Group | Regex |
|---|---|---|---|
| Application User ID | No | 1 | APPLICATIONUSERID: "([^"]+)" |
| Client Application | Yes | 1 | APPLICATIONNAME: "(.+?)" |
| Client Hostname | No | 1 | LOCALHOST: "(.+?)" |
| Executed Command | No | 1 | DATA: "([^"]+)" |
| Local User ID | No | 1 | LOCALUSERID: "([^"]+)" |
| Recording ID | No | 1 | RECORDINGID: "([0-9a-zA-Z]+)" |
| Resource Name | No | 1 | REMOTEHOST: "(.+?)" |