Ariel Property Expression Modified

I’m curious how I can map this event to the actual name of the property. The log seems to be missing some important information.

Jun 28 08:38:47 127.0.0.1 scrubbeduser@scrubbedhost (8022) /console/do/qradar/arielProperties | [Configuration] [ArielPropertyExpression] [ArielPropertyExpressionModified] ArielPropertyExpression( id=”ee114f54-9588-495b-9d25-0bff9419ec64″, category=”-1″, deviceId=”-1″, sequenceid=”0″, baseProperty=”com.q1labs.core.types.event.NormalizedEventProperties$Payload”, creationDate=”1498657127001″, payload=”[binary data]”, userName=”scrubbeduser”, editDate=”1498657127001″, arielRegexProperty=ArielRegexProperty(id=DEFAULTCUSTOMEVENT8), qid=”-1″, enabled=”true”, rank=”-1″, captureGroup=”1″, regex=”EventID=(d+)”, deviceTypeId=”12″ )

Related:

Leave a Reply