Modern IBM QRadar 7.5 SIEM Administration

Explore the IBM QRadar dashboards and pulse, offenses and log activity tabs, admin page settings, and the use case manager for correlation rules.

Learn to search QRadar logs by filtering on log source, IP, and event properties using the add filter button or interface, noting equals versus contains and basic parsing.

Explore core QRadar services such as accumulator, aerial proxy server, query server, and docker, and learn how restarts affect reports and searches.

Upcoming videos cover installing apps in QRadar, highlighting that non dedicated hosts allocate only 10% of RAM to apps. Uninstall curator assistant to free memory or install apps manually.

Learn to set up and configure the Use Case Manager in IBM QRadar, create building blocks and rules, and construct offenses with filtered events from Windows endpoints to generate alerts.

Explore how to use CQL inside QRadar rules, generate searches with saved searches, extract and apply the where clause, and balance rule specificity with performance.

Learn to troubleshoot QRadar rules by testing indexing configurations, identifying when an index is unavailable, and understanding how mismatched indexes or testing order affect offense triggering.

Learn how to optimize rules in a QRadar SIEM deployment by funneling detections from pfSense sources, prioritizing event ID filters, and narrowing by username or IP to boost performance.

Identify expensive rules by running the built-in script and sorting by average execution time and average test time, then disable or modify offending rules.

Explore Sigma rules as an open source markup for cross-system detections and apply them to Windows process creation events, focusing on command line details (event 4688) and event coalescing impacts.

Create a detection workflow using firewall logs to flag console logins outside working hours, filtering by console event IDs and applying a time window.

Learn to translate threat report IOCs into QRadar detections by building reference sets for IP addresses and hashes, and creating Conti ransomware alerts from threat intel.

Learn to work with reference data in IBM QRadar, including sets, maps, and tables, and manage them via tools or AppExchange, with bulk imports and time to live options.

Learn to manage reference sets from the default user interface—create, import/export CSV, delete, and set time-to-live and log options, with a note that the application is often more intuitive.

Learn how to integrate reference data with detections in QRadar by using reference sets, including or excluding usernames and event IDs, and creating tracking rules that populate reference data.

Learn to manage massive reference data in IBM QRadar by extending transaction check windows from 10 to 30 minutes for threat intelligence feed reference sets, then deploy configurations with restarts.

Add a managed host as a new event processor appliance in a distributed QRadar deployment. Install software, select event processor, and deploy changes to integrate the host with console.

use network hierarchy to name networks, assign ip ranges, and describe them with country and group; deploy changes and note the bulk csv tool's security risks for management.

Enable and manage IBM QRadar auto updates to receive parser, security, DSM scanner, and protocol updates; adjust frequency and choose manual versus auto install to avoid service disruption.

Explore event retention in QRadar: create buckets with targeted retention periods, apply filters for pfSense and Windows events, and manage distribution and precedence across buckets.

Learn to configure backup and recovery in IBM QRadar 7.5 SIEM, create on-demand backups, choose between configuration-only and configuration-and-data backups, set retention and time limits, and perform restores.

Modify offense email templates in QRadar by editing alert Config.xml, validating via the validation script, deploying changes, and using the new event templates to notify on detections.

Enable and manage indexing for the most used custom properties to boost search performance in IBM QRadar, while monitoring index health and storage impact to avoid performance degradation.

Configure resource restrictions in IBM QRadar by setting execution time, timespan, and record limits for specific users, roles, or tenants to prevent long or excessive searches.

Discover how routing rules in IBM QRadar 7.5 SIEM administration use filters to drop unwanted events, reducing license usage, and learn how to apply rules for windows and firewall data.

Explore XPath queries to filter Windows events at the endpoint using the win collect management console, defining paths and event IDs, generating XML queries, and forwarding selected events to curator.

Explore log source management in IBM QRadar 7.5: manage, enable, disable, edit, filter, and batch update log sources, export to CSV, and deploy changes after adding new sources.

Evaluate per log source whether to enable event coalescing, as it groups similar events and can hide or miss critical detections if misapplied.

Explore log source groups in IBM QRadar, create and organize parent-child groups, assign firewalls and Windows endpoints, and use groups to apply detections across sources.

Export event data from IBM QRadar searches by editing columns (visible or all), grouping by custom properties, and exporting to CSV or XML for troubleshooting or client reports.

Create and customize log source types in QRadar with the DSM editor, add custom properties like account name, and define event mappings with parsing options such as regex or json.

Configure a reference map to translate error codes into meanings and dynamically populate a new custom property, 'error code meaning', during event parsing in IBM QRadar 7.5 SIEM.

Learn how to create and map custom properties for log sources, switch between JSON and regex parsing, and manage event category and event ID mappings in QRadar.

Enable geolocation with MaxMind by creating a license key and configuring geographic settings, integrate X-Force curator, deploy, and tailor detections using local versus remote network hierarchy.

Verify GeoIP changes in QRadar by connecting to the console, running the update check, and performing a full deploy, then rerun until it shows IP-based flag icons.

Enable the X-Force threat intelligence feed in QRadar to integrate IBM X-Force data, perform IP lookups, drive detections, and manage daily 30 MB of IP data.

Discover how to manage users in QRadar by creating, editing, and deleting accounts, configuring authentication, roles, security profiles, and tenants, and setting inactivity timeouts with deployment of changes.

Define and manage user roles to control permissions and dashboards in QRadar. Assign permissions like offenses, log activity, network activity, and platform configuration.

This lecture shows how security profiles restrict access to networks, log sources, and domains, enabling assignment of networks and log sources to users to limit visibility by client and domain.

Configure authentication policies by selecting a module (system, radius, tacacs, local directory, or saml) and enforce password policy options including minimum password length, complexity, lockout, and allow lists.

Create and run a report by saving a search, selecting a layout and time span, distributing results as pdf, html, xml, xls, or csv through the report console or email.

Explore the different search types in QRadar, including dynamic searches with aggregated functions and filtered searches, and learn to translate CQL queries to SQL for actionable insights.

Explore offense management in modern IBM QRadar, including offense chaining, protecting offenses, prioritization via magnitude (relevance, credibility, severity), and cleaning the SIM data model.

Share reports and searches by selecting a group or sharing with everyone, applying role and security profile filters so teammates can access them.