QRadar: Events mapped in DSM Editor displays with status Unknown in Log Activity

Part 1 - Adding QIDs in DSM Editor

1. Login on the QRadar Console.
2. Click the Admin tab.
3. In Events under the Data Sources section, click DSM Editor.
4. Highlight the Log Source type associated with the events that are displayed as Unknown, click Select.
5. Copy and paste the event payload in the workspace window.
   1. To obtain te payload, go to Log activity and get list of unknown events.
   2. These events can be obtained by using filter Payload Contains and you can use some payload information in value or also filter by log source to get all events for it.
   3. Once events are shown, double click the respective event to show the Event Information page.
   4. Copy the payload from Payload Information.
   5. Go to DSM Editor and paste the payload into the Workspace.   
6. Click the Event Mappings Tab.
7. Click the plus (+) icon next to the Filter field to add new QID.
   
8. In the Create a new Event Mapping window, enter an Event ID value that can be produced by this log source type.
   
9. Enter an Event Category value that can be produced by this log source type.
10. Click Choose QID... and the QID Records window opens.
11. Click Create New QID Record.
12. Populate the required fields.
    
    • Name - Event name
    • Description - Event description
    • Log Source Type - Affected log source type
    • High-Level Category - Based on event
    • Low-Level Category - Based on event
    • Severity - Based on event
13. Click Save
14. Click OK, Create, then Save.
    
    Result
    The event displays successfully parsed and mapped in DSM Editor.

1. Login on the QRadar Console.
2. Click the Log Activity tab.
3. If you are viewing events in streaming mode, click the Pause icon to pause streaming.
   
4. Complete a search for the events in question, then double click the event the QID was created for.
5. In the Event Information window, click Map Event, then the Log Source Event window opens.
6. Select the following values:
   • High-Level Category - Any
   • Low-Level Category - Any
   • Log Source Type - Effected log source type
   • QID/Name - Copy and paste the QID that you created previously

7. Click Search.

8. Select the QID that you created previously, then click OK and then OK again to exit.
   
   Result
   New events of the same type are parsed and mapped and then displayed correctly in the Log Activity tab.