Troubleshooting
Problem
A user is not able to see a Custom Event Property (CEP) called "Rule Name" to use it in the event filter when defining a new Routing Rule in QRadar®.
Symptom
Cause
"Rule Name" is a reserved name in the program code, therefore not usable.
Diagnosing The Problem
The CEP is listed under Admin > Custom Event Properties, and when examined, "Parsing in advance for rules, reports, and searches" option may be selected, however the "Rule Name (custom)" field is not visible under Filter.
Resolving The Problem
Create a new CEP with a slightly different name like (Rule - Name) with the same criteria and expressions, and create the Routing Rule using this CEP instead.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
04 March 2022
UID
ibm16537798