QRadar SIEM
QRadar Fundamentals
This roadmap provides a QRadar platform overview and explains core concepts and functionality. This roadmap uses five pathways for navigation.
Overview
These courses introduce you to basic QRadar concepts and architecture.
Core functionality
These courses explain the functional components and core concepts of QRadar.
Apps
These courses introduce you to the extensibility of the QRadar platform through deployment of additional apps.
Skill badges
IBM Digital badges provide valuable credentials that prove the skills you have obtained in a specific role.
Commercial courses
Commercial courses cover a broad range of fundamental tasks.Tasks are described in the course summary of each course. If you prefer an instructor-led training program, these commercial courses are for you. The topics covered in the commercial courses can also be studied through Security Learning Academy online courses.
QRadar SIEM Administrator
QRadar Administrators deploy, configure, and maintain the overall QRadar infrastructure based on a holistic deployment architecture. They further maintain all operational tasks to ensure that the QRadar solution performs according to the key performance indicators.
Operational Tasks
These courses teach you how to perform operational tasks for your QRadar environment.
DevOps
These courses teach you how to implement extensions and enhancements in your QRadar environment.
Troubleshooting
These courses teach you how to perform basic troubleshooting tasks in your QRadar environment.
QRadar SIEM Analyst
QRadar SIEM Analysts are responsible for monitoring security incidents, investigating security event log information and network flows, scheduling vulnerability scanning, and coordinating remediation activities.
Investigations
These courses teach you how to investigate and remediate security threats in your IT environment Operational Tasks
QRadar SIEM Architect
QRadar SIEM Architects work in unison with IT Security Architects in an organization to design the holistic QRadar deployment architecture by integrating important log sources, network flows, assets, and user population.
Operational Tasks
These courses teach you how to perform operational tasks for your QRadar environment.
DevOps
These courses teach you how to implement extensions and enhancements in your QRadar environment.
In this course, you learn about domain and tenant management capabilities in IBM Security QRadar. Managed Security Service Providers (MSSPs) use these capabilities to provide services to their customers in a shared multi-tenant environment. Multi-divisional organizations can benefit from these features as well.
Domain and tenant management capabilities are essential when you want to provide services from a shared QRadar environment. Every internal customer becomes a tenant in your QRadar deployment and each has different requirements. To separate your tenants' data, you define domains.
In this video, you learn about the following new capabilities and features of IBM Security QRadar 7.4:
- QRadar focus in 2020
- Platform updates
- Data management
- QRadar Network Insights
- QRadar Vulnerability Manager
- QRadar Apps
- QRadar Community Edition
IBM Security QRadar flows represent network activity by normalizing IP addresses, ports, byte and packet counts, and other data, into flow records, which are records of network sessions between two hosts. Flows are a differentiating component in QRadar that provide detailed visibility into your network traffic.
In this course, you learn how QRadar analyzes your flow data for applications, flow direction, and superflows. You also learn how to build a QRadar flow rule, and how to perform flow searches in QRadar.
This video provides an overview of key Log
Source Management app features. In addition to the overview, the video
demonstrates how to bulk add and bulk edit log sources, and how to test
log sources with the app.
Objectives
- Learn about the new Disconnected Log Manager feature
- Explore the Log Source Management app user interface
- Learn how to bulk add and edit log sources
- Learn how to test log sources to confirm whether they are configured correctly
This course teaches you how to avoid many common issues when configuring
log sources for QRadar that use the Log File protocol. In addition,
you also learn how to configure both FTPS and passwordless SCP
authentication for Log File log sources. Finally, you learn how to
configure and test Log File log sources in the QRadar Log Source
Management app.
This course provides an introduction to IBM Security QRadar architectural patterns for Managed Security Service Providers (MSSPs).
An MSSP provides
Security Operations Center (SOC) services to customers of different
sizes and requirements. This will result in different architectural
patterns and use of QRadar
Console, Event collectors (EC), Event processors (EP), and Disconnected
Log Collectors (DLC).
The intent of the MSSP SOC is to offer services to multiple clients and at the same time to ensure confidentiality, integrity, and availability of services and data to their clients. To accomplish this goal, the QRadar components can be deployed across three zones that rely on the QRadar core functions for data isolation, such as users access management, domains, and tenants.