Most analysts think…
Most people assume 'if the device is sending syslog to QRadar, it must be working'. That is only half the picture.
The other half is the Device Support Module (DSM): the parser that turns raw log text into QRadar's normalised event taxonomy. Without the right DSM, QRadar stores events as unparsed strings — offenses never fire and reports show nothing useful. Understanding how log sources are discovered, how DSMs parse and coalesce, and when to reach for the Universal DSM or DSM Editor is what separates an analyst who can onboard any device from one who is permanently waiting for an IBM content update.
① Log sources — what they are and how QRadar finds them
A log source in QRadar is any device, application, or cloud service that sends events into QRadar — firewalls, Windows servers, Linux hosts, cloud-trail feeds, IDS appliances, databases. Each log source has a log source type (e.g. Cisco ASA, Microsoft Windows Security Event Log) that tells QRadar which DSM to use for parsing.
QRadar discovers log sources in two ways. Auto-discovery fires when traffic arrives on the Event Collector from a previously unseen IP or identifier — QRadar creates a draft log source and assigns the best-match DSM automatically. Manual addition via Admin > Log Source Management lets you pre-configure sources before traffic arrives, choose the exact protocol (syslog, JDBC, SFTP, REST API, Windows event collection) and tune how events are labelled and grouped.
Log source coalescing kicks in when many similar events arrive in a short window — QRadar merges them into a single event with an event count, preventing event-count storms from flooding the console. The coalescing window and threshold are tunable per log source.
QRadar event coalescing is primarily designed to…
② DSMs — how Device Support Modules parse and normalise events
A Device Support Module (DSM) is QRadar's parser for a specific vendor and product. It contains regex patterns, field mappings, and event-category mappings that transform raw log text (syslog, Windows event XML, JSON, CEF) into QRadar's normalised taxonomy: source IP, destination IP, username, event ID, event category, and the High Level Category / Low Level Category (HLC/LLC) pair that determines which rules fire.
DSM content packs and updates
IBM ships DSMs through the DSM Content Packs available on IBM Fix Central and through the App Framework marketplace on newer versions. Keeping DSMs current matters because vendors change log formats — an out-of-date DSM silently produces events with category Unknown rather than raising an error. The Log Activity tab in QRadar shows the real-time parse status: look for Unknown or Stored event categories, which signal that the DSM is not matching the incoming format.
Any device or service sending events to QRadar. Defined by type, protocol, and DSM. Auto-discovered from incoming traffic or manually added in Admin > Log Source Management.
The parser for a specific vendor product. Contains regex, field mappings, and HLC/LLC category assignments that turn raw log text into structured QRadar events.
QRadar's fallback parser for unrecognised devices. Extracts best-effort fields but leaves event categories as Unknown — a signal to build a proper DSM.
An XML overlay on top of an existing IBM DSM that adds missing field extractions. IBM content pack updates still apply to the base DSM; the extension persists on top.
Before blaming the rule engine for a missing offense, filter Log Activity by the relevant log source and check the event category column. If you see Unknown / Unknown, the DSM is not parsing correctly — no rule will fire no matter how well it is written. Fix the DSM first, then re-test the rule.
Which QRadar taxonomy pair does a DSM assign to every parsed event to determine which rules fire?
③ Universal DSM and the DSM Editor — parsing without a vendor DSM
When no vendor-specific DSM matches an incoming log source, QRadar falls back to the Universal DSM. It extracts a best-effort set of fields (source IP, destination IP, payload) but leaves the event category as Unknown. This keeps events visible in QRadar without dropping them, but offenses that depend on specific categories will not fire. The Universal DSM is your signal that you need a proper parser.
The DSM Editor (Admin > DSM Editor) is QRadar's built-in parser authoring tool. You load sample log lines, write regex capture groups that bind to QRadar fields, map the output to an event category, and test the mapping live before saving. Once published, the custom DSM replaces the Universal DSM for that log source type. Key concepts in the Editor: expression sets (ordered regex rules tried top-to-bottom), property mappings (QRadar field to capture group), and event ID mapping (the string QRadar uses to name the event in Log Activity).
A log source extension is different from a full custom DSM: it is an XML overlay added on top of an existing DSM that extracts additional fields the base DSM misses. Use extensions when the vendor DSM exists but omits fields you need for a specific rule — you keep automatic IBM updates and layer your extra parsing on top.
A common mistake is editing the IBM-shipped DSM directly to add a missing field. When IBM releases a DSM content pack update, your changes are overwritten silently. Use a log source extension for adding fields to an existing DSM — the base DSM can be safely updated while your extension persists on top.
▶ Watch a custom device event get parsed end-to-end
An IoT sensor sends syslog; QRadar discovers it and falls back to Universal DSM. A new custom DSM is published and the same event becomes a fully categorised, offense-eligible record. Press Play, then Break it.
A new IoT sensor sends syslog to QRadar but its events show category 'Unknown' in Log Activity. What is the correct next step?
④ Operational practice — managing, tuning, and troubleshooting log sources
The Log Source Management app (Admin > Log Source Management, or the dedicated Log Source Management App on QRadar 7.4+) is where you see all log sources, their status (active, disconnected, error), last event time, events-per-second (EPS), and which DSM version is in use. A log source showing Last Event far in the past or status Error is the first indicator of a collection gap.
Common tuning tasks
When a log source generates too many nearly-identical events (e.g. a firewall denying the same scan every second), increase the coalescing threshold so events are merged before reaching the rules engine. When a device logs in a non-standard format, update or clone the DSM using the DSM Editor rather than raising a support case. For log sources that rotate IP addresses (virtual IPs, NAT sources), pin them by device identifier or name rather than source IP to prevent duplicate log source creation. Always check the Event Collector logs (Admin > System and License Management > System Log) when events stop — protocol errors, authentication failures, and syslog port conflicts all surface there first.
Priya at a Mumbai financial services firm faces this
After onboarding a new next-generation firewall, the QRadar offense for repeated firewall denies from an internal host never fires — but the firewall is sending syslog and Log Activity shows thousands of events per minute.
The firewall vendor recently changed its syslog format. The DSM is assigning every event to HLC = Unknown / Unknown instead of Firewall / Deny. Rules that test for HLC = Firewall never match.
Open Log Activity, filter by this log source, and inspect the event category column — all events show Unknown. Check the DSM version under Admin > Log Source Management.
Admin > Log Source Management > DSM column + Log Activity > Event Category filterDownload the latest DSM content pack for the vendor from IBM Fix Central and install it. If no update exists, open the DSM Editor, load a sample event in the new format, update the expression set to match the changed field positions, and republish the DSM.
Re-check Log Activity after the DSM update: events now show HLC = Firewall / Deny. Run a controlled test by triggering repeated deny events — the offense fires within the rule window.
A log source marked Active does not guarantee events are parsed correctly. Always verify: (1) Last Event time is recent, (2) EPS is in the expected range, (3) a sample event in Log Activity shows the correct HLC/LLC, not Unknown. Three green checks, then close the ticket.
A firewall log source shows Last Event time as 6 hours ago. What should you check first?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does a correctly-arriving syslog event still produce no offense in QRadar? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Log Source
- Any device or application configured to send events to QRadar — defined by protocol, source identifier, and the DSM assigned to parse its events.
- Device Support Module (DSM)
- The per-vendor parser in QRadar: regex expression sets, field mappings, and HLC/LLC category assignments that transform raw log text into structured events.
- HLC / LLC
- High Level Category and Low Level Category — QRadar's event taxonomy that determines which rules fire and how offenses are named.
- Universal DSM
- QRadar's fallback parser for unrecognised devices. Extracts best-effort fields but leaves event category as Unknown — the signal to build a proper DSM.
- DSM Editor
- The built-in QRadar tool (Admin > DSM Editor) for authoring custom parsing expression sets, field mappings, and category assignments for any log format.
- Log Source Extension
- An XML overlay added to an existing DSM that extracts additional fields without modifying the base parser — safe to keep when IBM ships DSM updates.
- Event Coalescing
- QRadar feature that merges multiple near-identical events within a short time window into one event record with an event count, preventing EPS storms.
- Auto-Discovery
- QRadar automatically creates a draft log source when traffic arrives from an unrecognised IP or identifier and assigns the best-match DSM.
📚 Sources
- IBM — QRadar SIEM Log Source Management documentation. ibm.com/docs/en/qsip
- IBM — QRadar DSM Configuration Guide — Device Support Modules, parsing and HLC/LLC categories. ibm.com/docs/en/qradar-on-cloud
- IBM — QRadar DSM Editor: building and testing custom DSMs. ibm.com/docs/en/qradar-common
- IBM — Log Source Extensions in IBM QRadar SIEM. ibm.com/docs/en/qsip
- IBM — Universal DSM: parsing events from unsupported log sources. ibm.com/support/pages/qradar
- IBM Fix Central — QRadar DSM Content Packs (current versions). ibm.com/support/fixcentral
What's next?
Confident with log sources and DSMs? Next, go deep on QRadar rules and building correlated offenses — how the AQL-backed rule engine turns individual events into actionable security incidents.