To map a raw log event to a QRadar Identifier (QID) using the DSM Editor, QRadar requires a unique key. This key is a composite of the Event ID and the Event Category. While official documentation confirms both fields must be specified to create a unique mapping, the Event ID serves as the primary and most specific identifier for an event. It often corresponds directly to a message code or unique name from the source device. The Event Category provides a broader classification. In the context of a single mandatory field, the Event ID is the most fundamental component required to distinguish one event from another.

A. High-level Category: This is a property of the QID record itself, used for categorization and reporting within QRadar, not a field from the log used for the mapping lookup.

B. Low-level Category: Similar to the high-level category, this is a descriptive attribute of the QID, not part of the composite key used to map the event.

C. Event Category: While the Event Category is also a required component of the composite mapping key, the Event ID is considered the primary and more specific identifier for the event.

1. IBM QRadar DSM Configuration Guide (Version 7.5.0), Chapter 10: DSM Editor, Section: "Mapping events", Page 100.

The guide states, "For each event that you want to identify, you must specify an Event ID and an Event Category to create a QID map entry." This confirms that both are required for the composite key, establishing the context that the Event ID is the primary identifier within that pair.

2. IBM QRadar API Reference Guide (Version 7.5.0), Section: qidmap, Endpoint: POST /qidmap/qidmaps.

The API documentation for creating a new QID map entry lists both eventid (string) and eventcategory (string) as "Required" parameters in the request body. This reinforces that both are mandatory from a system standpoint, with eventid being the principal event identifier.

3. IBM Security QRadar SIEM Administration Guide (Version 7.3.1), Chapter 11: Managing event sources, Section: "QID map entries", Page 173.

The documentation explains, "The QID map links an Event ID and an Event Category to a QID." This phrasing highlights the two components that form the link, with the Event ID being the primary name or code for the event being mapped.