QRadar: Creating a report that uses a Custom Event Property (CEP)

• About custom event properties
• Step 1 - Creating the custom event property to locate interface values
• Step 2 - Creating a search with your custom event property
• Step 3 - Creating a report that uses your search
  
   

About custom event properties

Step 1 - Creating the custom event property to locate interface values

1. Log in to the QRadar user interface with any web browser.
2. Click Log Activity tab.
3. Double-click a Cisco ASA firewall deny event to view the event details page.
4. From the navigation bar, click Extract Property. The Custom Event Properties window is displayed.
5. Configure the custom event properties values in QRadar.
6. Click New Property.
7. Select the Enable for use in Rules, Forwarding Profiles and Search Indexing checkbox.
8. From the Field Type drop-down, select Alphanumeric.
9. Type a description for the custom event property.
10. Ensure that the Enabled checkbox is selected.
11. In the Extraction field, type your regular expression. The regex in this case is.

    interface\s(.*)\b

12. Click Test to validate your regular expression. The expected value from the event payload should be highlighted.
13. If the value from the event payload was properly highlighted, click Save.
    
    Results
    The custom event property is now created and the user can create a search to leverage the custom property.
     

Step 2 - Creating a search with your custom event property

1. Click the Log Activity tab.
2. From the navigation bar, select Search > New Search.
   
   
    
3. In the Time Range field, select a time frame. In this example, we are going to select Recent > Last Hour.
4. In the Group by field, add the new extracted property, which is Customer Interface (custom).
5. In the Search Parameters field, type Log Source and select the log source for your Cisco ASA device.
6. Click Add to add the quick filter to the search. The filter ensures that only Cisco ASA events are returned by your search.
7. Click Search.
   
   
   
    
8. Verify the search results are correct and that the Interface column is displayed.
9. From the navigation bar, click Save Criteria.
   
    
10. Type a Search Name and assign the search to a Group(s) to make your search easily to locate.
    
11. Click OK.
    
    Results
    The search is now created and can be leveraged in QRadar reports.
    
     

Step 3 - Creating a report that uses your search criteria

1. Click Reports tab.
2. Click Actions > Create to start a new report.
   
    
3. Using the Report Wizard, set the schedule and layout for your report.
4. To enter a title for your report, type a title in the Report Title field.
5. From the Chart Type drop-down, select Events/Logs.
6. Click Define to set the report parameters.
   
    
7. Define the parameters for the report container, such as the Chart Title, Graph Type, and Limit Events. Set Scheduling (if applicable). Select the saved search that was created in step 11.
   
   
    
8. Click Save Container Details.
9. Select an output format. The options are PDF, HTML, RTF, XML, or XLS.
   
10. Click Next.
11. Click Finish.
    
    
    Results
    The report template is created, if the report was not configured to run after saving, the user can highlight the report, then select Actions > Run Report to run the report immediately. Depending on schedule, there might be no data until the next day. After the report finishes, the user can view the report results by clicking the report from the Formats column.