Creating custom rule attributes
Create, edit, or delete custom rule attributes and their values. Then, you can assign the custom attribute values to a rule and add the custom attribute as a report column on the Use Case Explorer page. An attribute can be any string, and can have one or more values on the rule.
- From the IBM® QRadar® Use Case Manager menu, click .
- Click the plus sign icon in the Custom rule attribute section of
the window, add a unique name for attribute, and click the checkmark icon to add it to the
list. The name is used as a column header in the reports. Custom attribute data appears only for installed rules.
- Click the plus sign icon in the Custom rule attribute value
section of the window and enter a value for the attribute. Each custom attribute must include at
least one value. Tip: A value can be numerical, text, or special characters.
- Click Save and close when you are finished.
- To add custom rule attributes to the table report, modify the column settings by clicking
the gear icon in the report menu bar.
- Search or scroll down the window to find the column that you want to add to the report.
- In the Selected columns section of the window, drag the columns in the order that you want them displayed in the report.
- Click Apply.
You can export rules with their custom attribute mappings from the report menu bar. For more information, see Exporting rules.