Events Displayed As Custom Message
Problem: Illumio events are named IllumioASPCustom Message rather than being identified with the correct QRadar category. This is seen in the Log Activity tab in QRadar when you are searching for events related to created log sources.
Cause: This issue can be caused by improper Event ID and Event Category extractions. If any new type of event appears in the Log Source and its Event ID or Event Category extractions are not written, the value of that property will be empty.
Go to Log Activity.
In Filter Log Source Type, choose Illumio ASP V2.
In the View filter, select Last 7 Days.
Right-click on the event that has the IllumioASPCustom Message and select View in DSM Editor.
Check the value of Event ID and Event Category under Log Activity Preview.
If Event ID and Event Category are unknown, create a support ticket with Illumio Support.