QRadar SIEM V7.5 Admin flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Deployment Editor

QRadar UI tool where host roles and component allocation are defined; changes are staged and applied to all hosts via 'Deploy Changes' before taking effect.

All-in-One appliance

Deployment model where the Console, Event Processor, Flow Processor, and apps run on a single host; suitable for small environments and lab setups.

EPS license limit

Maximum events per second the Console license permits; events above the limit are dropped rather than queued, so monitoring EPS is required to avoid data loss.

Managed host addition

Process of adding a host to a deployment; requires matching QRadar version and patch level plus SSH key exchange before the host can receive a deployment.

Log Source Identifier

Value that maps incoming events to a specific log source; for syslog it defaults to the sender's IP or hostname, and a mismatch causes unknown or mis-attributed events.

DSM

Device Support Module that defines how QRadar parses a specific device's events; without a matching DSM, events parse only as generic Unknown events.

Coalescing

Event pipeline feature that merges duplicate events sharing QID, source, destination, and username within a time window to reduce volume and storage use.

Log source extension

Custom mapping added to a log source to parse event fields the base DSM does not handle, without writing a full new DSM.

Event pipeline stages

Collector receives raw events, Processor parses and enriches them via DSMs and rules, and Storage writes them to the Ariel database for search.

Network hierarchy

Tree of networks and groups with IP ranges, names, and countries; used by rules, reports, and offense filters to attribute events and flows to networks.

Flow source

Configured source of flow data such as NetFlow, sFlow, IPFIX, or QFlow packets; each is bound to a collector interface and stored on the Flow Processor.

QFlow

Packet capture on a monitored interface that converts traffic into flow records; requires a dedicated interface and is disabled by default on most appliances.

Asset database

Repository of discovered and manually entered assets populated from events, flows, and scans; rules referencing asset groups match only when the asset exists there.

Building block

Reusable rule fragment invoked by other rules through the Building Block test; it does not create offenses directly and must be referenced by a rule.

Create Offense response

Rule response that generates an offense when the rule fires; offense magnitude is the sum of contributing event magnitudes, with severity derived from magnitude and credibility.

Rule precedence

Order in which rules evaluate; rules marked High priority run before Medium and Low, and rule groups organize rules for enable and disable operations.

Anomaly rule

Rule that compares current activity to a learned baseline; requires the anomaly engine enabled and a baseline period before it can fire.

Custom property

Field extracted from raw events by regex, JSON, or XML expression after DSM parsing; stored in Ariel for search and rule use and must be deployed before use.

Extracted property

Custom property whose value is indexed for faster search; appears in the Log Activity Extracted Properties column and speeds up filtering.

QID

QRadar Identifier that categorizes a parsed event by high-level and low-level category; a wrong QID breaks categorization and rule matching.

DSM field mapping

Mapping of raw device fields to QRadar common fields such as source IP, destination IP, username, and QID during the parsing stage.

Tenant

Data isolation unit that limits a user to specific events, flows, offenses, and assets; tenants map onto domains, the underlying data partitions.

Security profile

Configuration defining allowed networks, login restrictions, session timeout, and password policy; assigned to roles or users and inherited by their accounts.

Role permissions

Admin manages users and deployment; SOC Analyst manages offenses and rules; Read-Only can view but not modify; custom roles combine granular permissions.

Directory authentication

LDAP or Active Directory login for QRadar users; directory groups are mapped to QRadar roles so permissions follow group membership.

Configuration backup

Backup of settings, rules, users, and configuration without event or flow data; restored to a host at the same or newer QRadar version.

Full backup

Backup that includes configuration plus Ariel event and flow data; larger and slower than configuration-only backups and used for disaster recovery.

High Availability pair

Primary and secondary appliance with synchronous replication; failover is automatic on primary failure and requires a dedicated replication network and matching hardware.

Disaster recovery restore

Rebuilding a deployment from backup on new hardware; requires license re-activation on the Console and re-adding and re-deploying managed hosts.

Ariel data retention

Per-data-type setting for how long events, flows, offenses, and assets are kept; increasing retention without adding storage causes earlier purging.

Data Node

Host added through the Data Node app to extend Ariel storage for events and flows; must be deployed and added to the Console before participating in storage.

qradar.error log

Log file at /var/log/qradar.error recording errors and exceptions; used with qradar.log and qradar-supervisor.log for troubleshooting failed services and deployments.