Network Hierarchy, Flow Collection, and Asset Discovery
This domain covers the network hierarchy, flow ingestion, and how QRadar learns assets.
Core rules
- The network hierarchy defines local networks and groups. It drives local-versus-remote classification, flow direction, offense source/destination labels, and asset identity.
- Build a top-level network, then groups and subnets; overlapping or missing ranges produce wrong direction and wrong offense attribution.
- Flow sources define who may send flows: NetFlow, sFlow, IPFIX, or QFlow. The Flow Collector receives, the Flow Processor runs flow rules, and flows are stored separately from events.
- Asset data comes from the Asset Profile, enriched by events, flows, scans, DHCP, and DNS. Assets can be stale if discovery is not scheduled.
Worked example
An internal 10.0.0.0/8 flow is labeled remote. The hierarchy contains only 192.168.0.0/16, so QRadar cannot classify 10.x as local. Add 10.0.0.0/8 under the correct group, deploy, and recheck the flow direction. The flow itself was always received; the classification was wrong.
Traps
- Confusing a network hierarchy Domain with a tenant; they are different features.
- Overlapping subnets that make the longest-prefix match ambiguous.
- Forgetting to define a flow source, so flows are dropped at the collector.
- Assuming asset discovery is automatic and complete.
- Editing the hierarchy without deploying.