To uniquely identify the fields that you want to extract from a JSON object, your JSON expression must follow specific JSON keypath conventions.

When you create a log source extension, you might encounter some parsing issues. Use these XML examples to resolving specific parsing issues.

You create log source extensions (LSX) when log sources don't have a supported DSM, or to repair an event that has missing or incorrect information, or to parse an event when the associated DSM fails to produce a result.

The DSM Editor is a new capability introduced in QRadar 7.2.8 that allows you to create a custom parser for getting your events into QRadar in a usable and user friendly way. This page will give an overview of how to use the editor and then create an extension to share your creation.