QRadar can work in the Deployment Model which is master and slave environment. The single master is the console, which manages the configuration updates for all the managed hosts (slaves) available in the deployment set. The console only has the ability to read and write to Postgres database, while the all managed hosts have read-only... / READ MORE /
Architecture
Please find below embedded three movies by Jose Bravo about migrating from App Node to App Host. App Host is new component in QRadar family. It has number 4000 and it works like normal Managed Host. You can doubled the component in High Availability cluster in the same way like other Managed Hosts in your... / READ MORE /
As promised in the last month, please find the second part of the QRadar 7.3.2 features article. As for today (mid of February), a new version is still not available for public, but I could see another new build generated in this month (20190201201121) and I believe we are days only from issuing a new... / READ MORE /
Among new features introduced in version 7.3.1, one of the most important would be a change in Traffic Analysis. Change reasons Many users have had issues with incorrectly auto detected log sources. In some extreme cases, incorrectly detected devices can have a major performance impact, which would lead to degradation on ecs-ec. The solution for this problem... / READ MORE /
Event retention helps QRadar administrators keep up and organize the data collected by their SIEM system. Retention window. Click the Admin tab Retention window to configure the buckets applicable to your deployment. By default, the Event Retention functionality provides a default retention bucket and ten not configured retention buckets. Events buckets System stores all events in the default retention bucket... / READ MORE /