IBM Support

IBM QRadar Custom Property Extension: IBM DB2

Question & Answer


A new security content pack is available for IBM DB2. This tech note outlines the changes and provides installation instructions for administrators.


Tab navigation

The DB2 Custom Property Extension adds one new event property 'Authid' for administrators. This new custom property builds on the existing 18 custom event properties that ship with QRadar by default.

Custom event properties added by the IBM DB2 extension

Property name Expression Added by
Authid checkid=([ˆ\t]+) Extension v1.0.0
Access intent intent=([^\t]+) QRadar default
Command cmd=([^\t]+) QRadar default
Current SQL id SQLid=([^\t]+) QRadar default
Data set name dsn=([^\t]+) QRadar default
Event Summary sum=([^\t]+) QRadar default
Job name job=[^\t]{29}([^\t]{8}) QRadar default
Object name(s) obj=([^\t]+) QRadar default
Object type(s) objtyp=([^\t]+) QRadar default
Person name name=([^\t]+) QRadar default
Plan plan=([^\t]+) QRadar default
Port of entry poe=([^\t]+) QRadar default
Resource sensitivity sens=([^\t]+) QRadar default
Sensitive groups usrGroups=([^\t]+) QRadar default
Sensitive user privileges usrPriv=([^\t]+) QRadar default
Submitted by submitby=([^\t]+) QRadar default
Subsystem name subsys=([^\t]+) QRadar default
System SMF id job=([^\t]{4}) QRadar default
System/job job=([^\t]+) QRadar default

Installing a QRadar Extension

The Extension Management window in QRadar is used to add applications to your deployment to improve the functionality or add customize content to QRadar. Extensions can contain content, such as rules, reports, searches, reference sets, and dashboards or extensions can install applications that deliver specific new functionality to QRadar. The About tab of this article will outline the contents of the extension being added to QRadar.


  1. Log in to the QRadar Console as an administrator. If you have not downloaded the extension yet, you can download files from

  2. Click the Admin tab.

  3. Click the Extension Management icon.

  4. To upload an extension, click Add and select the extension to upload.

  5. Note:The extension (zip) must be downloaded to your local computer before it can be uploaded to the Console appliance.

  6. To install the extension immediately, select the Install immediately check box and then click Add.

  7. A preview of the application content is displayed. You can choose how existing content items are handled.

  8. To preview the contents of an extension after it is added and before it is installed, select it from the list of extensions, and click More Details.

  9. Before the extension is installed, the content items are compared to content items that are already in the deployment. If the content items exist, you can choose to overwrite them or to keep the existing data.

    After the extension is added, a yellow caution icon in the Status column indicates potential issues with the digital signature. Hover the mouse over the triangle for more information. Extensions that are unsigned or are signed by the developer, but not validated by your vendor, might cause compatibility issues in your deployment.

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - 3rd Party","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 April 2020