IBM Security Privileged Session Recorder
Use the IBM® QRadar® IBM Security Privileged Session Recorder Custom Properties to closely monitor your IBM Security Privileged Session Recorder deployment.
Important: To avoid content errors in this content extension, keep the associated DSMs
up to date. DSMs are updated as part of the automatic updates. If automatic updates are not enabled,
download the most recent version of the associated DSMs from IBM Fix Central
(https://www.ibm.com/support/fixcentral).
IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.1
The following table shows the custom properties in IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.1.
| Name | Optimized | Capture Group | Regex |
|---|---|---|---|
| Resource Name | Yes | 1 | REMOTEHOST: "(.+?)" |
IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.0
The following table shows the custom properties in IBM Security QRadar IBM Security Privileged Session Recorder Custom Properties 1.0.0.
| Name | Optimized | Capture Group | Regex |
|---|---|---|---|
| Application User ID | No | 1 | APPLICATIONUSERID: "([^"]+)" |
| Client Application | Yes | 1 | APPLICATIONNAME: "(.+?)" |
| Client Hostname | No | 1 | LOCALHOST: "(.+?)" |
| Executed Command | No | 1 | DATA: "([^"]+)" |
| Local User ID | No | 1 | LOCALUSERID: "([^"]+)" |
| Recording ID | No | 1 | RECORDINGID: "([0-9a-zA-Z]+)" |
| Resource Name | No | 1 | REMOTEHOST: "(.+?)" |