To configure a log source in IBM QRadar SIEM V7.5 to provide events to different domains, administrators can use custom properties. Here’s how it works:
Custom Properties: Create and configure custom properties to tag events with specific domain information.
Assigning Events: When events are ingested from a log source, these custom properties can be used to dynamically assign events to different domains based on predefined criteria.
Domain Management: This approach allows flexibility in managing and segregating data from a single log source across multiple domains, ensuring that each domain receives the relevant events.
ReferencesThe configuration of custom properties for domain assignment is detailed in the QRadar SIEM administration guides, providing step-by-step instructions for setting up and using custom properties for domain management.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit