Applies to 7.3.x family products
Customising QRadar interface, after issuing version 7.3.0, is rather a simple task. Users, willing to do it, don’t need to have more skills than editing and copying files in Linux. Obviously, don’t do this in production systems. This is not supported. You do this on own risk only. Edit qradar.properties Simple edit the file below, […]
Soon (the first quarter of 2019), we can expect a new version of QRadar. This is a sneak peek at QRadar 7.3.2, which runs on RHEL 7.5. New version introducing so many improvements, that I could not list all of them at once. In this article, I describe only the most significant changes for me, […]
Among new features introduced in version 7.3.1, one of the most important would be a change in Traffic Analysis. Change reasons Many users have had issues with incorrectly auto detected log sources. In some extreme cases, incorrectly detected devices can have a major performance impact, which would lead to degradation on ecs-ec. The solution for this problem […]
Event retention helps QRadar administrators keep up and organize the data collected by their SIEM system. Retention window. Click the Admin tab Retention window to configure the buckets applicable to your deployment. By default, the Event Retention functionality provides a default retention bucket and ten not configured retention buckets. System stores all events in the default retention bucket if you don’t […]
Missing /store partition can sometimes seem in your QRadar, due to unsafe close of your server (hard reboot or power fail incident). In result, you can run into troubles caused by xfs file system corruption. This ends up with the /store partition not properly mounted by QRadar. Normally, in Red Hat 7, during boot up, you […]