IBM Support

QRadar: Custom Event Property not appearing in event properties list for use

Question & Answer


Why are my custom properties not showing up in rules, routing rules, reports, and searches?


The option "Enable for use in Rules, Forwarding Profiles and Search Indexing" was not selected when the custom property was created.
For Rules only: The custom property must be defined for the record type that the rule is testing against. Event Rules can use only Custom Event Properties, Flow Rules can use only Custom Flow Properties, and Common Rules use only normalized properties that exist as both as Custom Event Property and Custom Flow Property. If the rule is configured to be a Common Rule, user-generated custom properties are not available for use.


To resolve this issue:
  1. Go to the QRadar UI.
  2. In the Admin tab under Data Sources, open Custom Event Properties.
  3. Select the Custom Property that you are having issues with and edit it.
  4. In Custom Event Properties under the Property Definition section, ensure that check box for Enable for use in Rules, Forwarding Profiles and Search Indexing is selected.

    Custom Event Property configuration window highlighting where to enable
  5. Click Save.  Note: There is no need to Deploy Changes.
The custom property is available to for use from the custom property list

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtrAAA","label":"Rules"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Historical Number


Document Information

Modified date:
10 November 2023