Hi everyone. I'm trying to get a clearer picture of our security alerts by organizing offenses per department. We have our assets tagged with business unit info (like "Finance," "HR").
I've built a basic report grouping offenses by source IP, but I can't figure out how to make it use our asset's custom "Business_Unit" property. The report just shows IPs, not the department names.
Can someone walk me through the steps to create a report that lists offenses with the actual business unit from the asset model? I'm using QRadar 7.5.
Still learning...
Trying to figure it out.
Assets aren't assets without custom properties, they're just IPs with commitment issues. You're stuck on the grouping.
Go edit your report, not the dashboard. In the "Group By" section, you need to drill into "Source" then "Asset Properties". Your custom "Business_Unit" should be lurking there. If it's not, that property isn't mapped correctly to your assets in the model, which is a whole other can of worms.
Once grouped, the department names should pop in, assuming your asset mapping is actually working. If it's still empty, the report is fine, your asset model is the problem. Check those property mappings first.
Good luck. It's always the asset model.
Deploy with love