Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Creating Custom Rule Attributes

Create, edit, or delete custom rule attributes and their values. Then, you can assign the custom attribute values to a rule and add the custom attribute as a report column on the Use Case Explorer page. An attribute can be any string, and can have one or more values on the rule.
  1. From the QRadar Use Case Manager menu, click Settings > Custom Rule Attributes.
  2. Click the plus sign icon in the Custom rule attribute section of the window, add a unique name for attribute, and click the checkmark icon to add it to the list.
    The name is used as a column header in the reports. Custom attribute data appears only for installed rules.
  3. Click the plus sign icon in the Custom rule attribute value section of the window and enter a value for the attribute. Each custom attribute must include at least one value.
    Note:

    A value can be numerical, text, or special characters.
  4. Click Save and close when you are finished.
  5. To add custom rule attributes to the table report, modify the column settings by clicking the gear icon in the report menu bar.
    1. Search or scroll down the window to find the column that you want to add to the report.
    2. In the Selected columns section of the window, drag the columns in the order that you want them displayed in the report.
    3. Click Apply.
You can export rules with their custom attribute mappings from the report menu bar. For more information, see Exporting rules.

Related Documentation