QRadar SIEM V7.5 Admin study plan

Diagram the full QRadar deployment chain from event ingestion through the Console, naming the role of each host type (Event Processor, Event Collector, Flow Processor, Flow Collector, Data Node, Console) and stating which components can be co-located versus must be dedicated.

Explain how Ariel, the accumulator, and the payload/event pipeline interact, and trace a single test event from receipt on a collector to storage in an Ariel database, writing the path in your own words.

Size a deployment on paper for a stated scenario (for example 40,000 EPS plus 60,000 FPM and 90-day retention) and justify the processor, memory, and storage figures you choose.

List the steps of an initial Console setup in order, including hostname and network settings, license application, and time synchronization, and note the failure symptom for each step when skipped.

Identify which deployment tasks require a maintenance window and which can be done live.

Configure two log sources end to end (one syslog, one agent-based) and verify events arrive by checking log activity and log source status, capturing the exact menu path you used.

Diagnose three deliberately broken ingestion cases (wrong protocol, wrong port, mismatched log source identifier) and document the symptom and fix for each.

Map the difference between a log source type, a log source protocol, and a log source extension, and state when each is the right tool.

Explain the role of auto-detection and how to tune or disable it, and describe the risk of leaving it unmanaged in a large environment.

Describe how event coalescing and licensing interact, and identify which events count against EPS.

Build a network hierarchy that reflects your environment, including NAT and non-routable ranges, and explain how hierarchy placement affects offense and flow behavior.

Configure a flow source (for example NetFlow or a QFlow collector) and confirm flows appear in network activity with correct direction and interface data.

Explain how asset discovery and server discovery populate asset profiles, and tune a discovery scan or profile to reduce noise.

Describe how the network hierarchy, asset profiles, and rules combine to determine whether a flow is internal, external, or a boundary crossing.

Identify the three most common reasons flows show up but do not populate as expected and how to confirm each.

Write a custom rule from scratch that generates an offense, choosing the correct test, and explain why you selected that test over alternatives.

Build a building block and call it from a parent rule, then demonstrate the difference in rule response behavior when the building block changes.

Configure offense tuning: severity, credibility, relevance, and the offense naming and annotation fields, and explain how each affects what an analyst sees.

Explain how rule responses (such as event annotations, syslog, and notifications) execute and where they can fail silently.

Trace how an offense is created, coalesced, and closed, and identify the settings that control each stage.

Create a custom event property using a regex, test it against real sample payloads, and verify it appears in the event details and is usable in a rule.

Explain the difference between a custom property and an extracted property, and state which one to use when the value must be shared across log sources.

Debug a regex that over-matches or fails on a subset of events by isolating the failing payload and iterating on the pattern.

Write a rule that uses the new custom property as a test, confirming the property resolves at rule evaluation time.

Describe how property extraction affects parsing performance and what to check when extraction slows event processing.

Create a user role with least privilege for a tier-one analyst and prove the restriction by logging in as that user and confirming blocked actions.

Configure a tenant and a domain, assign a user to it, and verify data visibility boundaries from that user's session.

Explain how security profiles interact with user roles and where the two overlap or conflict.

Perform a backup and a restore in a lab or documented procedure, including the configuration backup versus full backup distinction and the restore order.

Describe the high availability and disaster recovery options available and the failover behavior and data-loss window for each.

Inspect Ariel database retention and storage allocation, then adjust a retention policy and confirm the effect in storage metrics.

Read the key health and performance views (system health, event and flow pipeline, EPS and FPM trends) and identify what a degrading trend looks like.

Locate and interpret the core log files and identify which log to check for ingestion, rule, and console errors.

Diagnose a simulated performance problem using the tools available, such as queue depth, dropped events, and storage thresholds, and state the first three checks you would run.

Explain how tuning (such as coalescing, property extraction, and rule count) trades accuracy against throughput.

Complete a timed full-length practice set and score each domain separately to expose weak areas.

Re-study the two lowest-scoring domains using your own notes and deliverables from earlier weeks.

Re-explain from memory the deployment chain, the offense lifecycle, and the backup and restore order, without notes.

Review every missed practice question and write the underlying fact or procedure it tested.

Confirm you can state the difference between the top five most-confused concept pairs you encountered across the plan.