IBM Support

QRadar: Ariel Right Click Properties Troubleshooting

How To


Summary

Troubleshooting Right Click Properties feature in QRadar 7.3.1.

Objective

This article outlines troubleshooting the Ariel Right Click Properties feature in QRadar 7.3.1.

Steps

This process explains how to create and verify a new property exists.
  1. Create a property in the DSM Editor. In this example, we create two new properties: Test_Field_1 and Test Field 2.
    image-20181001103222-2
  2. Check that the property exists in the Database by using the following commands:
    psql -U qradar -c "\x" -c "select propertyname from Ariel_regex_property where propertyname like '%Test%';"  
    Example output:
    [ RECORD 1 ]+--------------
    propertyname | Test_Field_1
    
    [ RECORD 2 ]+--------------
    propertyname | Test Field 2
  3. Set up the configuration file. Modify /opt/qradar/conf/arielRightClick.properties by using the following example template:
    Note: It is case-sensitive and the same format defined in pluginActions must be consistent with the properties. 
    pluginActions=XFE_URL_Lookup,Test_Field_1,Test Field 2
    
    # begin XFE integration.   #(Integrated in QRadar by IBM)
    
    XFE_URL_Lookup.arielProperty=URL
    XFE_URL_Lookup.text=X-Force Exchange Lookup
    XFE_URL_Lookup.url=https://exchange.xforce.ibmcloud.com/#/url/$URL$
    
    
    # end XFE integration
    
    Test_Field_1.arielProperty=Test_Field_1  #(My manually-defined property 1)
    Test_Field_1.text=Test Field 1 test
    Testl_Field_1.url=https://www.virustotal.com/#/search/$Test_Field_1$
    
    Test Field 2.arielProperty=Test Field 2  #(My manually-defined property 2)
    Test Field 2.text=Test Field 2 test
    Test Field 2.url=https://www.virustotal.com/#/search/$Test Field 2$
  4. Restart Tomcat by using the following command:
    systemctl restart tomcat
  5. From the QRadar GUI, navigate to Log Activity > New search and add the new custom fields (Test_Field_1 a Test Field 2) into Columns and click the Filter button. 
    image-20181001103255-3
  6.  Filter the traffic needed by hovering over one of the newly defined columns, right-clicking, then selecting Plugin Options and your new property. The property is Test Field 2 test in this example.
    image-20181001103343-4
Result
You created a property, confirmed it exists in QRadar, and filters properly.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"Ariel - Right Click Properties","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
27 May 2022

UID

ibm10733112