IBM Support

QRadar: Identity Username missing from DSM Editor



Unable to select []Identity Username[] to map Asset information in the DSM Editor.


Identity Username is a special case. As far as the Log Source Extension is concerned, it is not actually it's own field. Identity Username is derived from the Username value. As long as identity is enabled for a given event mapping and the Username field is populated for that event, the Identity Username should automatically be populated with the Username value.

Resolving The Problem

To resolve the issue, map the event to use Username instead of the Identity Username as shown in the following screen capture.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018