What custom property types does QRadar support?

Question

Options

• AJAR, LEEF, JSON
• BASN.1, JSON, Regex
• CLEEF, JSON, Regex
• DJSON, LEEF, STIX2

• A
  18% (4)
• B
  5% (1)
• C
  73% (16)
• D
  5% (1)

Explanation

Option C is correct because QRadar's Custom Event Properties feature supports exactly three extraction types: LEEF (IBM's Log Event Extended Format), JSON (for parsing structured JSON payloads), and Regex (regular expressions for flexible pattern-based extraction from raw log text). These three methods cover IBM-native, structured, and freeform log parsing scenarios.

Why the distractors fail:

• A (JAR, LEEF, JSON): JAR is a Java archive format - it's not a log parsing mechanism and has no role in QRadar custom properties.
• B (ASN.1, JSON, Regex): ASN.1 is a data encoding standard used in certificates and network protocols, not a QRadar property type.
• D (JSON, LEEF, STIX2): STIX2 is a threat intelligence sharing format - useful in threat feeds, but not a custom property extraction type in QRadar.

Memory tip: Think "JLR" - JSON, LEEF, Regex - like a luxury car brand. JSON handles structured data, LEEF handles IBM's own format, and Regex handles everything else. If an answer includes anything outside those three (JAR, ASN.1, STIX2), it's wrong.

No community discussion yet for this question.