QRadar SIEM V7.5 Admin cheat sheet

QRadar deployment types: All-in-One (console plus all apps on one host), Console plus managed hosts, and Console plus dedicated Event and Flow processors; a Console is required in every deployment.

Event Processor stores and searches events; Flow Processor stores and searches flows; Data Node extends storage for both via the Data Node app; all are managed by the Console over port 443 (tomcat) and 32006 (hostcontext).

Deployment Editor defines host roles and component allocation; changes are staged, then deployed with 'Deploy Changes' - the deployment must complete on all hosts before the configuration is active.

Default network ports: 443 console web/API, 22 SSH, 514 syslog UDP, 6514 syslog TLS, 2055 NetFlow, 32000-32999 inter-host services, 5000-5099 appliance internals.

Initial setup checklist order: license and activation key, network settings, hostname and DNS, NTP/time zone, root password, then Deployment Editor component assignment and deploy.

A QRadar license is bound to the Console's IP or hostname and to the number of Events Per Second (EPS) and Flows Per Minute (FPM) allowed; exceeding EPS causes events to be dropped, not queued indefinitely.

Managed host addition requires matching QRadar version, patch level, and SSH key exchange between the Console and the new host before the host appears as 'Added' and can receive a deployment.

Tuning parameters such as EPS limits and storage allocation are set per host in the Deployment Editor and take effect only after a successful full deployment.

Log Source Identifier (LSI) is the key that maps incoming events to a log source; for syslog it defaults to the sending IP or hostname, so a mismatched LSI produces 'unknown' or mis-attributed events.

Log source types come from the DSM (Device Support Module); a log source without a matching DSM parses only as generic 'Unknown' events with no custom properties.

Protocols: Syslog (UDP/TCP 514), Syslog-TLS (6514), SNMP, JDBC/ODBC polling, Log File protocol (SCP/SFTP pull), WinCollect, and the QRadar Log Source Management app for bulk editing.

Coalescing events reduces volume by merging duplicate events sharing the same QID, source, destination, and username within a time window; coalescing is disabled for events that carry unique payload data.

Event pipeline stages: Collector (receives raw), Processor (parses, applies DSMs, custom properties, rules), and Storage (writes to Ariel database); a parse failure stops enrichment after the Processor.

Log source extensions add custom event mappings and properties for unsupported devices without writing a full DSM.

Auto-discovery detects new log sources sending to QRadar; discovered sources must be reviewed and mapped to the correct DSM type before parsing works correctly.

Anomaly detection (Rules and off-seat detection) requires a baseline; enable it per log source only after the source is stable, since baseline restarts on log source changes.

The Network Hierarchy groups IP ranges into networks and groups; each network can be assigned a name, country, and description used by rules, reports, and offense filters.

Built-in network objects: 'Any', 'Local NAT', and default private ranges; overlapping or incorrectly ordered network definitions cause flows and events to be attributed to the wrong network.

Flow sources include NetFlow v5/v9/v10 (IPFIX), sFlow, Packets (QFlow/span port), and QRadar Network Insights; each flow source is bound to a flow collector interface.

Flow data is stored in the Flow Processor and queried via the Flow Viewer; superflows aggregate flows by source, destination, and application for reporting.

Asset discovery populates the Asset database from events, flows, and vulnerability scans; assets can be edited manually or imported via CSV.

Asset profiles link assets to rules; a rule referencing an asset group only matches when the asset is present in the asset database and the event/flow references that asset.

QFlow captures packets on a monitored interface and converts them to flows; it requires a dedicated interface and is disabled by default on most appliances.

Network hierarchy changes apply to new data; historical events and flows retain the network attribution recorded at ingest time.

Rule components: tests (conditions), and responses (actions such as 'Dispatch New Event', 'Create Offense', 'Execute Custom Action'); a rule fires only when all tests evaluate true.

Building blocks are reusable rule fragments invoked by other rules via the 'Building Block' test; they do not generate offenses directly and must be referenced by a rule.

Rule precedence: rules are evaluated in order; a rule marked 'High' priority runs before 'Medium' and 'Low'. Rule groups organize rules for enable/disable.

Offense creation requires a rule with the 'Create Offense' response; offense magnitude is the sum of contributing event magnitudes, and offense severity is derived from magnitude and credibility.

Offense retention: offenses close automatically after the configured inactivity period (default 30 minutes for 'inactive' state); closed offenses remain searchable for the retention window.

The Rules Wizard provides templates for common detections (e.g., multiple failed logins, new port); custom rules are created in the Rule Editor with the same test/response model.

Anomaly rules compare current activity to a learned baseline; they require the anomaly engine enabled and a baseline period before firing.

Rule testing uses the 'Rule Test' function against historical events; a rule that matches no historical events either has wrong tests or the data is not yet parsed.

Custom properties (CPs) extract fields from raw events using regex or JSON/XML expressions; they apply after DSM parsing and are stored in the Ariel database for search and rules.

Property types: 'Regex' (regular expression with capture group), 'JSON' (JSON path), 'XML' (XPath), and 'Calculated' (expression referencing other properties).

A custom property must be enabled and deployed before it appears in searches; existing events are not retroactively re-parsed unless re-ingestion occurs.

Extracted properties are created from a custom property with 'Extract Property' enabled; they index the value for faster search and appear in the Log Activity 'Extracted Properties' column.

Regex capture groups: the first group is the value; use named groups or explicit capture to avoid capturing surrounding text.

DSM parsing maps raw event fields to QRadar's Common Event Expression fields (source IP, destination IP, username, QID); a wrong QID breaks categorization and rule matching.

The 'Log Source Extension' editor tests regex against sample raw events before deployment; use 'Test' to confirm the property extracts the expected value.

Property names are case-sensitive in searches; a property named 'UserName' is queried as 'UserName' not 'username'.

User roles: Admin, SOC Analyst, Analyst, Read-Only, and custom roles; permissions are granted by role and can be overridden per user.

Tenants isolate data (events, flows, offenses, assets) by domain; a user assigned to a tenant sees only that tenant's data. Domains are the underlying data partitions.

Security profiles define allowed networks, login restrictions (IP/hostname), session timeout, and password policy; a user inherits the profile assigned to their role or user record.

Authentication options: local QRadar users, LDAP/Active Directory, RADIUS, and TACACS+; directory users are mapped to QRadar roles via group-to-role mapping.

Admin role can manage users, deployment, and system settings; SOC Analyst can manage offenses and rules but not system configuration; Read-Only can view but not modify.

Tenant assignment is done in the User Management 'Tenant' field; a user with no tenant sees all domains (global access) only if granted the 'Admin' or equivalent permission.

Password policy settings (length, complexity, expiry, lockout) are configured in the Security Profile; the default admin password must be changed on first login.

API access uses authorized services tokens or username/password; tokens inherit the permissions of the user that created them.

Backup types: Configuration backup (settings, rules, users, no event data) and Full backup (configuration plus Ariel data); backups are scheduled in the Backup and Restore app.

Backup destination: local, NFS, or SFTP; the backup file is a compressed archive that can be restored to a host of the same or newer QRadar version.

Restore requires the target host to be at the same QRadar version and patch level; restoring a configuration backup does not restore event/flow data.

High Availability (HA) pairs a primary and secondary appliance with synchronous replication; failover is automatic on primary failure, and the secondary takes over the Console or processor role.

HA requires a dedicated replication network and matching hardware; the secondary must be added to the deployment and paired in the HA configuration.

Disaster recovery restores from backup to a new deployment; the license must be re-activated on the new Console, and managed hosts re-added and re-deployed.

Backup verification: check the backup log for completion status and confirm the archive size; a failed backup often indicates insufficient disk space or unreachable NFS/SFTP target.

Configuration backups should be taken before any deployment change, DSM update, or patch installation to allow rollback.

EPS and FPM license limits cap ingest; monitor 'Events Per Second' in the System Monitoring dashboard and check for dropped events when EPS is exceeded.

Ariel storage is divided into event and flow databases; retention is set per data type (events, flows, offenses, assets) in the System Settings 'Data Retention' page.

Storage allocation per host is set in the Deployment Editor; increasing retention without adding storage causes the oldest data to be purged earlier than configured.

Tuning options: coalescing, event suppression, log source filtering, and disabling unused DSMs reduce Processor load and storage consumption.

The 'System Monitoring' dashboard shows CPU, memory, disk, and EPS per host; sustained high CPU on the Processor indicates parsing or rule load, not necessarily storage.

Ariel database maintenance includes reindexing and purging; the 'Ariel Database' health check reports index status and free space.

Store-and-forward: collectors buffer events when the Processor is unavailable; buffer size is limited, and overflow drops events.

Data Node app extends storage by adding a host as a Data Node; the Data Node must be deployed and added to the Console before it participates in Ariel storage.

Key log files: /var/log/qradar.log (general), /var/log/qradar.error (errors), /var/log/qradar-supervisor.log (process supervision), and /var/log/audit/audit.log (audit trail).

Health checks run from the Console: 'System Health' shows component status; a red component indicates a stopped service, often resolved by restarting the service or redeploying.

The 'Deployment' status page shows per-host deployment results; a host stuck in 'Deploying' usually has an SSH or firewall issue between Console and host.

Unknown events: verify the Log Source Identifier matches the sending device, confirm the DSM is assigned to the log source, and check the raw event in Log Activity.

Use 'tcpdump' on the collector interface to confirm packets arrive; if packets arrive but no events appear, the issue is parsing (DSM) or the LSI mapping.

The 'qradar' CLI tools include 'qradar service restart', 'qradar deployment status', and 'qradar log' for quick diagnostics; run as root.

The 'Diagnostic' view in the UI shows process status per host; 'Restart' restarts a single process without a full deployment.

Time skew between hosts breaks correlation and offense timestamps; verify NTP synchronization on all hosts with 'ntpq -p'.