Getting to know DSM Editor
We have discussed in detail event data and the ingestion of event data in QRadar and now understand that IBM provides DSMs out of the box for QRadar to parse incoming event data. What happens when IBM does not have a DSM for a data source that you want to ingest? What would be the state of the ingested event data? Will it be partially parsed? To answer these queries, IBM has introduced a tool called DSM Editor. DSM Editor is built into Qradar; no special package is required for its installation.
In earlier versions of Qradar, there was a feature called Universal Log Source, where we had to define the parsing logic for incoming data. Parsers had to be written. As it was a manual process, it was not very efficient. But now with the DSM Editor, most of the processing is automatic.
Figure 5.3 – DSM Editor – unparsed events
In the preceding figure, we can see a few events that have a Low Level Category value of Unknown...
