DSM Editor enhancements
The DSM Editor enhancements in QRadar® 7.4.2 include generating regex to parse event properties.
Generating regex for parsing event properties
QRadar 7.4.2 can suggest regular expressions (regex) when you enter event data in the Workspace. If you are not familiar with creating regex expressions, use this feature to generate your regex.
Highlight the payload text that you want to capture and in the Properties tab, click Suggest Regex. The suggested expression appears in the Expression field. Alternatively, you can click the Regex button in the Workspace and select the property that you want to write an expression for. If QRadar is unable to generate a suitable regex for your data sample, a system message appears.
The following figure shows how you can generate your regex with the Suggest Regex button in the Properties tab, or with the Regex button in the Workspace.