This course focuses on two conceptual log source components. Protocols, which ingest event data into the QRadar ecosystem, and Device Support Modules, which act on this ingested data. You will learn about the roles of these components, and how they are aligned in the event pipeline.

With the advances of technology and the occurrence of data leaks, cyber security is a bigger challenge than ever before. Cyber attacks evolve as quickly as the technology itself, and hackers are finding more innovative ways to break security controls to access confidential data and to interrupt services. Hackers reinvent themselves using new technology features as a tool to expose companies and individuals. Therefore, cyber security cannot be reactive but must go a step further by implementing proactive security controls that protect one of the most important assets of every organization: the company's information.

This IBM Redbooks publication provides information about implementing IBM QRadar SIEM and protecting an organization's networks through a sophisticated technology, which permits a proactive security posture. It is divided in to the following major sections to facilitate the integration of QRadar with any network architecture:

•     "Before the installation" provides a review of important requirements before the installation of the product.
•     "Installing IBM QRadar V7.3" provides step-by-step procedures to guide you through the installation process.
•     "After the installation" helps you to configure additional features and perform checks after the product is installed.

In this Open Mic you learn about the enhanced Windows endpoint monitoring capability with Sysmon and QRadar. The IBM Security Support explains why you want to use Sysmon, and how to properly set it up.

In this QRadar WinCollect Troubleshooting Open Mic video, you will learn about the following topics:

• About WinCollect
  
• Managed vs standalone deployment
• Troubleshooting tuning issues 
• Error messages 
• General WinCollect troubleshooting 
• Troubleshooting with IBM Support 
• Q&A

Device Support Modules (DSM) enable QRadar SIEM to normalize events from raw logs received from various source types. These events must be parsed, normalized, and correlated into offenses to alert you to suspicious activities. In these exercises, you use the DSM Editor to create a log source type for an unknown source of events. You also configure the new log source type to parse and normalize its properties and create unique identifiers and mappings so that QRadar SIEM can name, rate, and categorize the events from the unkown log source.

WinCollect is a syslog event forwarder that collects Windows-based events from local and remote Windows-based systems and sends them to QRadar for processing and storage. In this video you learn about the two different WinCollect deployment models and how to manage them.

Using the table of contents menu in the video you can navigate to each one of these topics individually, or you can explore the content altogether:

• WinCollect overview
• WinCollect deployment models
• Installing and configuring a managed deployment
• Generating an authentication token
• WinCollect agent GUI installation
• WinCollect agent command line installation
• Upgrading all WinCollect agents to V7.2.8
• Troubleshooting a faulty WinCollect installation
  

In this QRadar Open Mic you learn about domains and tenants, and how these concepts are implemented and used. You also hear about tips and other helpful information for QRadar administrators.

This IBM Support Open Mic video covers topics around QRadar software updates and a best practice admin checklist.

• Before you begin 
• Patch and upgrade checklist 
• Firmware 
• Troubleshooting
  
• Reference
  

The capacity of a deployment is measured by the number of events per second (EPS) and flows per minute (FPM) that IBM QRadar can collect, normalize, and correlate in real time. The event and flow capacity is set by the licenses that are uploaded to the system. In this video, you learn about the features of managing the license event and flow capacity.

• Define functions of event and flow processing capacity, such as shared license pool, capacity sizing, and internal events
• Define burst handling

• Searching, filtering, and sorting capabilities
• Bulk editing
• Bulk deleting
• Adding new log sources using csv-file upload

In this video, you learn how to create building blocks and how they differ from QRadar custom rules. You will be able to leverage building blocks for their typical purposes of reducing complexity and resource consumption, facilitating reuse of functionality and information, as well as reflecting your organization's IT environment.

• Changing severity, credibility and relevance of the event or flow
  
• Adding the event or flow to an offense
  
• Annotating the event or flow
  
• Dropping the event or flow by rule action and routing rule

This video course explains how to set up an App Node server that is separate from your QRadar Console to offload the processing of apps in your deployment.

This IBM Security Support Open Mic video explains how QRadar uses log source protocols to collect event data, capturing configuration properties, error messages, and other use cases for data collection.

Objectives:

• Events FAQ and terminology
• Listening protocols (Syslog)
• Polling protocols (JDBC / Log File)
• Tips and performance Suggestions
• Specialty protocols (APIs)
• Questions and discussion
  

Custom log sources enable QRadar SIEM to normalize events from raw logs that have been received from various source types. These events must be parsed, normalized, and correlated into offenses to alert you to suspicious activities. Based on a business scenario, you will learn how to perform each step in the process of creating custom log sources.

QRadar collects network activity information, or what is referred to as "flow records".  Flows represent network activity by normalizing IP addresses, ports, byte and packet counts, as well as other details, into "flows", which effectively represent a session between two hosts. QRadar can collect different types of flows, which differ greatly in the collected details. In this video series, we explain and demonstrate the differences between the following network flow capture mechanisms:

• Cisco Netflow
• QRadar QFlow
• QRadar Network Insights (QNI)
  

With indicators of compromise or concern, you specify which activities you consider suspicious. Derive indicators from threat modeling while considering which kind of data QRadar SIEM can use to test for indicators. This course addresses the following topics:

• Getting started with threat modeling
  
• Using observables for indicators
  
• Using context for indicators
  
• Using external data for indicators
  

In this QRadar Open Mic, members of the IBM QRadar Support and Development teams discuss and demonstrate the following QRadar Apps:

• Pulse App
• QRadar DNS Analyzer
• Log Source Management App
• QRadar Assistant App
  

This Open Mic has been recorded on Tuesday, 28 August 2018.

IBM QRadar SIEM enables you to minimize the time gap between when a suspicious activity occurs and when you detect it. Attacks and policy violations leave their footprints in log events and network flows of your IT systems. QRadar SIEM connects the dots and provides you insight by performing the following tasks:

• Alerts to suspected attacks and policy violations in the IT environment
  
• Provides deep visibility into network, user, and application activity
  
• Puts security-relevant data from various sources in context of each other
  
• Provides reporting templates to meet operational and compliance requirements
  
• Provides reliable, tamper-proof log storage for forensic investigations and evidentiary use
  

Objective

The exercises in this lab provide a broad introduction into the features of QRadar SIEM. The exercises cover the following topics:

• Navigating the web interface
  
• Investigating a suspicious activity
  
• Creating a report
  
• Managing the network hierarchy

IBM QRadar needs to provide precise information about captured log events and network flows that have been collected within your network. It can only do that sufficiently after you provided enough contextual information about your network hierarchy and assets. 

This video series describes how to properly tune the following networking aspects:

• Introduction to QRadar and Tuning
  
• Domain Management
  
• Network Hierarchy Basics
  
• Structuring your Network Hierarchy
  
• Keeping the Network Hierarchy Updated
  

License keys entitle you to specific IBM QRadar products, and control the event and flow capacity for your QRadar deployment. You can add licenses to your deployment to activate other QRadar products, such as QRadar Vulnerability and Risk Manager. After you apply the license keys to QRadar, redistribute the EPS and FPM rates to ensure that each of the managed hosts is allocated enough capacity to handle the average volume of network traffic.

In this video, you learn about the features of managing licenses in QRadar SIEM.

Overview:

Rules can use threat intelligence data from sources outside your organization to test for known threats. Learn about the options to leverage threat intelligence data and make an informed decision on how to get started. This course addresses the following topics:

• Describe how threat intelligence data fits into the bigger picture
  
• Use external data
  
• Use built-in Remote Networks
  
• Use X-Force threat intelligence feeds
  

Duration:  9 minutes

Revision:  1.0

This video series describes how to properly tune the following aspects:

• Server Discovery and Host Definition
  
• The Basics of Rules and Building Blocks
  
• Content Packs and the QRadar Assistant App
  
• SIEM Tuning Report
  
• False Positive Tuning
  

Each QRadar Custom Rules Engine instance evaluates hundreds of test conditions on thousands of events and flows per second in real-time. The resource consumption of testing can cause a high system load so that real-time processing degrades. Therefore, rule developers need to consider the computational cost of tests and optimize accordingly. This guide helps rule developers to write efficient custom rules and building blocks.

You can back up and recover IBM QRadar configuration information as well as event and flow data by using the backup and recovery feature. However, you must restore event and flow data manually. There are two types of backups: configuration backups and data backups.

Objectives

• View backup archives
• Create an on-demand configuration backup archive
• Delete a backup archive
• Schedule nightly backup
• Import a backup archive

Stateful tests in rules, which are configured as local, are evaluated by the CRE instance that receives the events and flows. Stateful tests in rules, which are configured as global, are evaluated by the CRE instance on the Console. In this course you learn about both of these options, which allows you to make an informed decision on whether to configure a rule as local or global. This course addresses the following topics:

• Configuring rules as local or global
• Examining the effects on rules with only stateful tests
• Examining the effects on rules with only stateless tests
• Examining the effects on rules with both stateful and stateless tests
• Examining the effects on rule responses
• Considering pros and cons
  

Reports in IBM QRadar SIEM condense data to statistical views on your environment for various purposes, in particular to meet compliance requirements. In this lab, you run an a report from an existing template, then create a new report based on a saved search, and finally create a new report from a new search.

Anomaly detection aims to alert to threats that are undocumented and therefore cannot be detected by methods that monitor for well defined indicators. Such threats can be detected by monitoring for an unusual volume of activities. With IBM® QRadar® SIEM, create anomaly detection rules to monitor for deviations from the baseline of expected activities.

In these exercises, you develop an anomaly detection rule of type Anomaly. It tests for the deviation of the number of events matching a grouped search from the weighted moving average. The rule fires in the exercise because the sample data spikes above the deviation percentage configured in the anomaly rule.

License keys entitle you to use specific IBM QRadar products and control the event and flow capacity for your QRadar deployment. You can add licenses to your deployment to activate other QRadar products, such as QRadar Vulnerability Manager.

This self-paced course provides you the foundations of license management, their components, and explain how they are managed within QRadar.

Course Objectives

• Define ways to upload and maintain license keys in the QRadar SIEM console.

• Obtain hands-on experience with viewing license details, uploading a license key, allocating a license key to a host, deleting licenses, and exporting license information.

In this video, a panel of IBM QRadar experts talk about tuning QRadar, focusing on the following:

• Network hierarchy
  
• Host definition building blocks and reference data
  
• Server discovery
  
• QRadar content extensions
  
• Tuning methodology
  
• False positive rules
  

QRadar administration encompasses many different tasks. The installation and upgrade management course provides information about the following topics:

• QRadar Installations and Upgrades - Best Practices Open Mic (2014)
  
• Replacing a QRadar Console in your deployment
• Replacing a Managed Host in your deployment (non-HA)
  
• Installing a QRadar content pack from IBM Fix Central
  
• Performing a QRadar v7.3 software installation on your own appliance
  
• Performing a clean install of QRadar v7.3
  
• Upgrading to QRadar v7.3
  
• Upgrading QRadar Appliances in parallel
  
• Migrating a console to a new QRadar appliance with the same IP address
  
• YUM vs RPM Installation commands in QRadar
• How to mount an ISO image using IMM
  

Jonathan Pechta and Chris Fraser from QRadar Technical Support deliver this Open Mic LIVE at the 2018 Think conference that focuses on discussing the new features available in QRadar 7.3.1.

In this set of videos, we introduce the powerful capabilities of IBM QRadar SIEM.

• The first video depicts how data is ingested into the QRadar environment by collecting log information, network flow data, and vulnerability information. You learn about the asset model, and how the QRadar rules are used to create actionable offenses. In addition, the video explains the integration with IBM BigFix, as well as QRadar Risk and Vulnerability Manager.
• The second video starts off by explaining the concepts of QRadar Reference Sets and how to use them. It then takes a look at the forensic capabilities, and briefly introduces the deployment architecture.
• The third video focuses on integration capabilities between QRadar and IBM BigFix, IBM Guardium, network intrusion prevention systems, IBM Trusteer, IBM Identity Manager, and IBM mainframe SMF records,
• After a brief recap of the QRadar fundamentals, the fourth video explains many of the new capabilities that have been recently added to QRadar. These include the new appliances QRadar Network Insights, the Data Node, and the App Node. It then provides an overview of the QRadar API and the App Exchange, and takes a closer look at some of the available app extensions, including the BigFix App, User Behavior Analytics, Sysmon integration, and the QRadar Advisor with Watson. Finally, it introduces the new DSM Editor.
• Collecting and investigating network flows is one of the outstanding QRadar capabilities. The final video explains how QRadar approaches network flows, and how the security analysts benefit from this in their daily investigations.

•     Defining rules
•     Introducing the QRadar rules engines
•     Enabling rules
•     Duplicating rules
•     Editing rules
•     Creating rules
•     Navigating rule groups

Understanding the architecture of the IBM QRadar ecosystem is viable for everyone in IT Security who is concerned with solutions within the security immune system. By learning how the central Security Intelligence components are designed to take in and process log events and flow data, you will be better equipped to holistically work as a Security Analyst with IBM QRadar. This course includes three videos:

1. QRadar functional architecture and deployment models
   
2. QRadar SIEM component architecture
   
3. Dissecting the flow of a captured event
   

In this video, Adam Frank and Robert McGinley from the QRadar team deliver the Open Mic LIVE at the 2018 Think conference, which focuses on sizing and scoping your QRadar SIEM deployment.

An offense represents a security incident related to a suspicious attack or policy violation. As event and flow data passes through QRadar SIEM, it tests different conditions to generate an offense if such tests results are positive.

In this 2-part video course you learn about investigating offenses that are based on either events or flows.

QRadar administration encompasses many different tasks. The high availability course provides information about the following topics:

• Adding and removing an HA host
• Setting an HA host back online
  

This Open Mic video first explains the different cloud deployment architecture models for IBM QRadar and then spends some time to discuss the installation procedures for various cloud offerings. Take a look at the overall agenda:

• Third Party Cloud Vendors
  
• AWS Deployment Architecture Examples
  
• Azure Deployment Architecture Examples
  
• Installing QRadar in AWS Today
  
• Installing QRadar CE in AWS
  
• Installing QRadar in AWS (Soon)
  
• Instance Log Ingestion from Auto-Scaling Groups
  
• Resources
  

• Sorting rules by their contributions to offenses
• Grouping dispatched events by event name
• Grouping events by rules that triggered for them
• Grouping flows by rules that triggered for them
• Filtering by rules that triggered

This lab walks you through exporting get_logs from:

• QRadar SIEM's user interface, or
  
• the QRadar server.

Use IBM QRadar Apps to extend and enhance your current QRadar deployment with new data and ready-to-use use cases.  A QRadar app is a means to augment and enrich your current QRadar system with new data and functionality. You can download and install other shared apps that are created by IBM, its Business Partners, and other QRadar customers.

You can enhance the Windows log collection capability by using a publicly available tool called System Monitor (Sysmon). In combination with QRadar SIEM you can now process much more detailed events to protect your deployment from malicious attacks.

• Sysmon Introduction 
  
• Use Case 1 - Malicious File Injection and Execution 
  
• Use Case 2 - In memory attack 
  
• Use Case 3 - Base64 encoded data obfuscation 
  
• Use Case 4 - Hiding behind a common Windows service process 
  
• Use Case 5 - Malicious file injection using encrypted HTTPS 
  
• Use Case 6 - Detecting Other Libraries
  
• Use Case 7 - Privilege Escalation Detection
  
• Use Case 8 - More Privilege Escalation Detection
  
• Use Case 9 - Even More Privilege Escalation Detection
  
• Use Case 10 - Creating an Admin Account
  
• Use Case 11 - Detecting Name Pipe Impersonation
  
• Use Case 12 - Detecting Mimikatz
• Use Case 13 - Sysmon Lateral Movement Detection, Example One
• Use Case 14 - Sysmon Lateral Movement Detection, Example Two
• Use Case 15 - Sysmon Lateral Movement Detection, Example Three
• Use Case 16 - Sysmon Detecting BadRabbit
• Use Case 17 - Sysmon and Watson chasing BadRabbit

The IBM Security App Exchange is a collaborative platform that can help integrate and utilize the collective knowledge of security professionals through code sharing.  The App Exchange offers enhancements and integration between IBM Security products, and can include other security vendors, such as Trend Micro, Cisco, Qualys, and so on.
The majority of the security integration offerings today is available for the IBM® QRadar® product line.  The IBM Security App Exchange provides an expanded hub of QRadar content. IBM QRadar provides a RESTful API that allows access to the QRadar resources and data.

This lab guide demonstrates the tools that can help you to develop new apps for QRadar.  You can use two type of tools for your app development:

• QRadar App Editor
• QRadar SDK

The labs are using IBM QRadar Community Edition, or IBM QRadar CE.

This video series provides insight to troubleshooting activities for your IBM QRadar deployment.

• System Notifications and Error Messages (OpenMic)
• Understanding and troubleshooting IO errors when searching in QRadar
• How to use tcpdump for troubleshooting in QRadar
• Collecting QRadar System Logs
• QRadar Dynamic Systems Analysis

In this set of videos, we provide you with an overview of the IBM QRadar Deployment Architecture.

• Part one talks about the different QRadar appliance models and explains how they can be used in a variety of deployment architectures.
• Part two investigates how to deploy QRadar in remote locations. It also introduces the concepts of high availability, disaster recovery, and deployment options in virtual environments.
• Part three explains deployment options in cloud-based environments. 
• The final part compares deployment options for VMware and QRadar on the Cloud (QRoC)

Each event and flow is a record of an activity in you IT environment. For some events, and all flows, this activity includes a network connection. Many rules need to test, if this network connection is approved in your organization. The rules do this by testing whether the event or flow has been tagged by building blocks with names beginning with BB:HostDefinition and BB:HostReference. Their purpose is to signal QRadar SIEM, which network connections are approved in your organization. In this course, you learn how to approve network connections using these building blocks.

The QRadar SIEM Troubleshooting Tools course contains the following videos:

• The QRadar SIEM Troubleshooting Tools: Introduction to Log Files Part 1 and Part 2 provides an overview of the various log files available and when to use the each log file for troubleshooting.
• The QRadar SIEM Troubleshooting Tools: get_logs shows you how to collect logs for troubleshooting. It also details how to use some of the logs in troubleshooting QRadar issues

This video series introduces the IBM QRadar advanced search capability using the Advanced Query Language, or AQL. 

Part 1 - Quick Filter and UI Searches

Part 2 - AQL Introduction

Part 3 - Where, Group, Having, Order

Part 4 - Counting

Part 5 - Ref Set, Assets and UBA

Part 6 - Health Metrics and X Force

Part 7 - More Health Metrics and API calls

Part 8 - Payload, Indexed and Regex Searches

Overview

For each incoming event and flow, QRadar SIEM evaluates rules to test for indicators that suggest an attack or policy violation. In this lab, you learn how to create custom rules, building blocks, custom event properties, and a reference set to detect an example suspicious activity.

Objectives

• Create and use custom event properties
• Create and use a reference set
• Add tests to new custom rules and building blocks
• Leverage function tests
• Configure rule actions and responses

Duration

1 hour

Course Version

1.0


SEC9766

When working with custom QRadar Log Sources, you often have to deal with collected information that falls outside the standard normalized data, and this data might be considered important. The Custom Properties are a way to collect this information and use it for your ongoing for your investigations.

In this video series, we investigate various Ransomware, phishing, and malware attack use cases in QRadar.

• Stopping Ransomware in its tracks
  
• Discover Hidden Malware with QRadar
  
• QRadar and Bigfix Stop Ransomware
  
• Using QRadar and X-Force Exchange to protect against WannaCry ransomeware attack

QRadar dashboard items allow the user to focus on different areas of interest. This step-by-step demonstration introduces how to perform network analysis with dashboard items.

The Ariel Query Language (AQL) is a structured query language that you use to communicate with the Ariel databases. You can use AQL to extract, filter, and perform actions on event and flow data that you extract from the Ariel database in IBM Security QRadar. AQL is used for advanced searches to get data that might not be easily accessible from the user interface. This provides extended functionality to QRadar's search and filtering capabilities. In this lab you learn how to utilize AQL for some advanced search tactics inside QRadar SIEM.

Use the representational state transfer (REST) application programming interface (API) to make HTTPS queries and integrate QRadar with other solutions. In this series of videos you learn how to make best use of the QRadar API. 

IBM Security QRadar includes rules that detect a wide range of activities, including excessive firewall denies, multiple failed login attempts, and potential botnet activity. You can also create your own rules to detect unusual activity.  Custom rules customize default rules to detect this suspicious activity in your network.

Two major capabilities of QRadar SIEM are to integrate with many other solutions and platforms, and to provide an API platform that can be utilized to build powerful extensions. 

In this video series we focus on the QRadar extension capabilities. We address the following topics: 

• QRadar App Exchange Foundations
  
• QRadar App Development and Troubleshooting (OpenMic)
• Installation and configuration of the Incident Overview App
• Configuration of the X-Force Threat Intelligence feed
  

Every QRadar SIEM Analyst has to master basic investigations skills. In this video series you learn about the following topics: 

• Using flexible Searches to narrow down your investigations 
  
• Finding Anomalies
• Monitoring internal Log Sources

The QRadar SIEM Analyst has to perform many different tasks when it comes to the investigation of offenses, events, and flows. In this video series you learn about the following topics: - Detecting fraud and account takeover - Detecting communication to a malicious Command & Control Server - Detecting a remote scan followed by attempts to login - Detecting multiple Login Failures to Compliance Server - Detecting Chat to a malicious Site - Detecting UDP scan in flows from an IBM XGS Network Security appliance - Detecting phishing e-mails - Detecting awakening dormant Accounts - Detecting Fraud from a URL with Keyword from a bad IP - Detecting jailbroken iPhones using QFlows - Detecting insider threat - USB inserted and bad website visited

This video series introduces you to many basic concepts in QRadar SIEM. The following topics provide you with the foundational skills required to start your journey: 

• Dashboard Demo
• Working with Offenses Demo
• QRadar Events Overview
• QRadar Flows Overview
• Rules and Offenses
• Reports
• Coalescing
• Additional QRadar features
• Quick References
  

To properly understand the capabilities of QRadar SIEM beyond the basic concepts it is important to learn about Assets as well as Domain Segmentation and Multi Tenancy - Introduction to Assets (~ 4 min) - Assets in Detail (~ 50 min) - Domain Segmentation and Multi Tenancy - How to update the Network Hierarchy to prevent false positive Offenses

IBM QRadar enables you to minimize the time gap between when a suspicious activity occurs and when you detect it. Attacks and policy violations leave their footprints in log events and network flows of your IT systems. To connect the dots, QRadar SIEM correlates these scattered events and flows into offenses that alert you to suspicious activities. Using the skills taught in this course, you will be able to thoroughly understand and configure QRadar rules, work with reference data, and create and manage uncommon log sources.

• Create and manage uncommon log source types
• Leverage reference data collections
• Develop and manage custom rules
• Develop and manage custom action scripts
• Develop and manage anomaly detection rules

IBM QRadar SIEM provides deep visibility into network, user, and application activity. It provides collection, normalization, correlation, and secure storage of events, flows, assets, and vulnerabilities. Suspected attacks and policy breaches are highlighted as offenses. In this course, you learn to navigate the user interface and how to investigate offenses. You search and analyze the information from which QRadar SIEM concluded a suspicious activity. Hands-on exercises reinforce the skills learned.

Objectives:

• Describe how QRadar SIEM collects data to detect suspicious activities
• Describe the QRadar SIEM component architecture and data flows
• Navigate the user interface
• Investigate suspected attacks and policy breaches
• Search, filter, group, and analyze security data
• Investigate the vulnerabilities and services of assets
• Use network hierarchies
• Locate custom rules and inspect actions and responses of rules
• Analyze offenses created by QRadar SIEM
• Use index management
• Navigate and customize the QRadar SIEM dashboard
• Use QRadar SIEM to create customized reports
• Use charts and filters
• Use AQL for advanced searches
• Analyze a real world scenario

In this self-paced course, you will do a deep dive in the foundations of the IBM QRadar Application Framework components and learn how they are managed within QRadar.

This course teaches you how to take advantage of the information posted in IBM X-Force Exchange (XFE) platform by using the API, curl tool, and python language.

The course also demonstrates integration between XFE and QRadar SIEM using XFE SDK and direct integration or Threat Intelligence Application and TAXII endpoints.

Objectives

• Learn how to leverage the X-Force Exchange API, curl tool, and python scripts to pull threat data from the X-Force Exchange platform
• Install the Threat Intelligence app in QRadar SIEM
• Test the API using online documentation
• Use curl commands and the X-Force Exchange API documentation to simulate browser requests
  
• Write a python script that uses X-Force Exchange API code
• Use TAXII feeds, collections, and the QRadar Threat Intelligence app to integrate the X-Force Exchange API and QRadar SIEM
• Configure threat data feeds to monitor and detect ransomware outbreaks