Peak EPS Exceeds License and Collectors Shed Events
Your QRadar deployment is licensed for 7,500 EPS. During a monthly business peak it sustains 9,800 EPS for about six hours. System Monitoring shows event drops on both Event Collectors, collector CPU averages 88%, and store-and-forward queues drain slowly after the peak. A proxy generates 45% of all events, mostly allowed URL category traffic that analysts rarely use. The license cannot be increased this quarter, and the business will not accept losing firewall deny or authentication events. Retention is 30 days, and disk is at 70%. The CIO asks for a fix that does not require new hardware and does not silently blind the SOC. You have two weeks before the next peak.
1. Distinguish the immediate mitigation from the structural fix, and explain where you would reduce volume first.
Read the worked answer
The immediate mitigation is to stop the collectors from being overwhelmed during the six-hour peak; the structural fix is to align generated volume with licensed and tested capacity. I would reduce volume at the source first, starting with the proxy's allowed URL category logging, because it is the largest low-value stream and the business has already said deny and authentication events matter more. Ask the proxy owner to log only denied or risky categories, or to aggregate allowed traffic, rather than filtering inside QRadar after the events have already consumed collector capacity and license. In parallel, confirm whether any log source is duplicating events through two paths, and check whether store-and-forward is masking sustained overflow rather than preventing it. I would not start by dropping events at the collector with a broad filter: that is fast but hard to audit and can remove evidence. Any reduction must be documented with the owner, the retained categories, and a rollback path.
2. How would you decide whether to filter events at the source, at a relay, or in QRadar, given the audit requirements?
Read the worked answer
The decision should weigh where the event is still useful and who owns the evidence. Source-side reduction is best for high-volume, low-value categories because it saves license, collector CPU, and network bandwidth, and the proxy owner can document the configuration. Relay filtering is attractive when the source cannot change but you need to protect the collectors; it keeps QRadar cleaner but adds a hop that must be monitored and can become an unaudited hiding place. In-QRadar filtering is the least efficient for capacity because the event has already been received and licensed, though it can be appropriate for narrow, well-logged suppressions. Given the audit requirement, I would choose source reduction for allowed URL categories and keep a sampled or summary record if policy requires evidence of allowed traffic. I would reject silent collector drops entirely. The test is whether an auditor can answer what was excluded, by whom, and for how long, without reading packet captures.
3. What risks remain after the volume reduction, and how would you verify readiness before the next peak?
Read the worked answer
Remaining risks include a shift in proxy logging that removes a category investigators later need, a peak that grows beyond the new baseline, and hidden duplication elsewhere in the pipeline. Verification should be a load test or a replay of representative peak traffic, not a hope that the next month behaves. Measure collector EPS, CPU, and drop counters at the new configuration; confirm store-and-forward queues return to zero within an agreed interval; and check that firewall deny and authentication test events still appear. I would also set alerts on event-drop counters and on EPS approaching 85% of licensed capacity so the next peak is visible before users report missing data. Finally, document the excluded categories and the approval, and schedule a post-peak review. If the reduction does not create enough headroom, the honest options are license expansion, additional collectors, or a formally accepted loss of a named data category, not continued silent dropping.