Perform the following procedure only if you had to add Feed Service to QRadar as a log source manually because you did not have the latest QRadar updates. Use the procedure to specify the Log Source Type
property of the added custom event properties.
To specify the log source type of the added custom event properties:
Admin tab of QRadar Console
The Custom Event Properties window opens.
Custom event properties
A Custom Event Property Definition window opens.
The Existing Property option was selected before you changed the value in the Log Source Type drop-down box. However, after you changed the log source type, the New Property option was selected. Therefore, you have to select the Existing Property option again.
Custom event property definition
The log source type of every custom event property will now be Universal LEEF.