In QRadar, when evaluating domain criteria based on an event, the precedence order for domain assignment if the event does not match the domain definition for custom properties is as follows:

Log Source: The first criterion checked is the log source. Each event is associated with a log source, and the domain is determined based on this source.

Log Source Group: If the log source does not provide a domain match, the next criterion is the log source group. Log sources can be grouped together, and domain definitions can be applied at the group level.

Event Collector or Data Gateway: If neither the log source nor the log source group provides a match, QRadar checks the event collector or data gateway for a domain definition.

DDS (Data Domain Service): As the final step, if no other criteria match, the DDS is used to assign the default domain.

This order of precedence ensures that the most specific criteria are checked first before falling back to more general criteria, ensuring accurate domain assignment for events.

ReferencesIBM Security QRadar SIEM and IBM Security QRadar EDR integration.pdf​