Custom Event Properties

Perform the following steps to customize event properties:

  1. Go to Admin > Log Sources.

    Ensure the status of QualysMultiline Log Sources is Enabled. 

  2. Go to Admin > Custom Event Properties.

    Reconfirm that all 27 Qualys-related properties are Enabled and are linked to the Qualys LEEF log source type.

The following table includes Qualys-related properties :

Field name
  • App Version
  • PCI Flag
  • Qualys QID
  • Severity Level
  • QID Category
  • CVE
  • Last Fixed Datetime
  • Operating System
  • Qualys Host ID
  • Tracking Method
  • First Found Datetime
  • Qualys Severity
  • Last Scan Datetime
  • App ID
  • Last Test Datetime
  • Detection Type
  • Patchable
  • Last Update Datetime
  • Network ID
  • Last Found Datetime
  • QID Title
  • Host IP
  • Status
  • DNS
  • Tags
  • Unique Vuln id
  • source 

For the Qualys-related properties, recheck the following points:

  1. If any property is disabled, enable it.

  2. If any property does not belong to the Qualys LEEF log source type, open it to edit and select Qualys LEEF as the log source type

  3. If any property does not belong to the QualysMultiline log source, open it to edit and select QualysMultiline as the log source.

  4. Ensure that all Custom Event Properties have Event Name as QualysMultiline Information. If not, select Event Name as QualysMultiline Information.

  5. Save the properties.

If you do not see the properties, refer to the Troubleshooting section in this document to learn how to delete and recreate Log Source Type Qualys LEEF.

For any change in Custom Event Properties, it is recommended to do Deploy Full Configuration.

Next Step

Configure App


‎

© Qualys, Inc. All rights reserved. Privacy Policy.