Question & Answer
Question
This article informs administrators about QRadar® Support policies. QRadar Support assists administrators to investigate and correct software defects related to regular expression assistance. This document outlines out-of-scope cases for QRadar users.
Answer
Responsibilities for Regular Expression issues
Regular expressions are used to match patterns of text in Log Source events. Administrators can scan messages for patterns of letters, numbers, or a combination of both. For example, you can create regular expressions that match source and destination IP addresses, ports, MAC addresses, and more. Regular expressions are used in Log Source extensions, custom event properties.
Support type | Description | Responsibility |
Regular Expressions and support |
QRadar® Support can assist with error messages or confirm product functionality for IBM created regular expressions. For example, QRadar Support can:
|
QRadar technical support To open a case or report a regular expression issue, contact QRadar technical support. |
Out-of-scope for QRadar Support | Administrators are responsible for their regular expressions. The following activities are considered out-of-scope for technical support and IBM reserves the right to close cases related to:
Administrators need to be able to create, modify, test, and tune their regular expressions. For assistance administrators can test their expressions with online tools, like regex 101. IBM offers tuning for regular expressions and custom property assistance through IBM Security® Expert Labs.
|
|
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]
Was this topic helpful?
Document Information
Modified date:
08 June 2021
UID
ibm16427781