Custom Event Properties

Perform the following steps to customize event properties:

Go to Admin > Log Sources.
Ensure the status of QualysMultiline Log Sources is Enabled.
Go to Admin > Custom Event Properties.
Reconfirm that all 27 Qualys-related properties are Enabled and are linked to the Qualys LEEF log source type.

The following table includes Qualys-related properties :

Field name
App Version
PCI Flag
Qualys QID
Severity Level
QID Category
CVE
Last Fixed Datetime
Operating System
Qualys Host ID
Tracking Method
First Found Datetime
Qualys Severity
Last Scan Datetime
App ID
Last Test Datetime
Detection Type
Patchable
Last Update Datetime
Network ID
Last Found Datetime
QID Title
Host IP
Status
DNS
Tags
Unique Vuln id
source

For the Qualys-related properties, recheck the following points:

If any property is disabled, enable it.
If any property does not belong to the Qualys LEEF log source type, open it to edit and select Qualys LEEF as the log source type
If any property does not belong to the QualysMultiline log source, open it to edit and select QualysMultiline as the log source.
Ensure that all Custom Event Properties have Event Name as QualysMultiline Information. If not, select Event Name as QualysMultiline Information.
Save the properties.

If you do not see the properties, refer to the Troubleshooting section in this document to learn how to delete and recreate Log Source Type Qualys LEEF.

For any change in Custom Event Properties, it is recommended to do Deploy Full Configuration.

Next Step

Configure App

Custom Event Properties

Next Step

‎