QRadar: Rules with email responses that leverage custom properties can cause search and ariel writer exceptions (APAR IJ21718)

Cause

1. An administrator creates a custom event property for a log source, but does NOT select the option to parse the custom property for rules or searches.
   - In the DSM Editor, this value is not selected: Enable this Property for use in Rules and Search Indexing.
   - In the Custom Event Property interface, this value is not selected: Parse in advance for rules, reports, and searches.
2. User A creates new rule that includes the administrator's custom property to ensure that when the rule triggers that an email response is sent.
3. User B creates a search with the administrator's custom property and requests the data from the Event Processor appliance.
4. As event data is evaluated by the Event Processor, rules engine needs to update the custom property map against incoming events to ensure data is collected as part of the rule test and email.
5. The data expected in search query from user B is requested at the same moment the rule test evaluation updates the custom property map.
   
   Summary
   As the custom property was not configured for use in rules and searching, the search query is expecting to stream the search results from the custom property map. However, the custom rules engine increments the size of the custom property at the same moment to include the data for the rule response. When the search request and rule update occur at the same moment for the same serialized custom property data, a concurrency exception is created and the error message in the APAR is written in the logs.