Step 10 (optional). Enabling the indexes of the added custom event properties

We recommend that you enable the indexes of the added custom event properties. This will increase the performance of Kaspersky Threat Feed App.

To enable the indexes of the added custom event properties:

1. In QRadar, select Admin and under System Configuration select Index Management.

   

   Admin tab of QRadar Console (system configuration tools)

   The Index Management window opens.

2. Optionally, specify the filter to find the added properties.
3. Select one or several table rows, and click Enable Index.
4. Click Save.

   A message box appears that asks you whether you want to save the changes you made.

   

   Saving changes to the indexes

5. Click OK to save changes to the properties.

Page top