The standard method in IBM QRadar to segregate events from a single log source into multiple domains is by using custom event properties. A custom property is configured to parse a unique identifier from the event payload (e.g., a customer name, IP address, or virtual firewall context). The domain management system is then configured to use this custom property's output. When an event is processed, QRadar extracts the identifier and assigns the event to the corresponding domain, enabling multi-tenancy from a centralized log collector.

A. Saved searches on the Network Activity tab are for viewing network flow data, not for assigning log events to domains. Domain assignment occurs during event processing, not during a search.

B. The Assistant app is a troubleshooting and guidance tool. It does not provide the primary interface for configuring the logic required to route events from one source to multiple domains.

D. The Use Case Manager app is used for managing and tuning security rules, reports, and their associated building blocks. It operates on events after they have been assigned to a domain.

1. IBM Security QRadar SIEM Administration Guide: In the section on Domain Management, the documentation explicitly states the procedure for this scenario. It details creating a custom property to extract a domain-defining field from the event payload and then using that property in the domain definition.

Reference: IBM Security QRadar SIEM Administration Guide, (Version 7.5.0), Chapter: "Domains", Section: "Domain definition for events". The guide states, "To assign events from a single log source to different domains, you must create a custom property that you can use to assign the incoming events to a domain."

2. IBM Security Learning Academy: Courseware for QRadar Administration covers multi-tenancy and domain segmentation. These materials explain that for log sources that aggregate data from multiple tenants (like a central syslog server), custom properties are the mechanism to parse and direct events to the correct domain.

Reference: IBM Security Learning Academy, QRadar SIEM Administration Course, Module on Multi-tenancy and Domains. The course material demonstrates creating a regex-based custom property and applying it to domain definitions.