Catalog Navigator

IBM QRadar SIEM Advanced Topics

Sizing and scoping your QRadar deployment - Open Mic

Click roadmap title to expand/collapse roadmap

QRadar SIEM Administrator

The total time required to complete this roadmap is 50h 41m.

QRadar Administrators deploy, configure, and maintain the overall QRadar infrastructure based on a holistic deployment architecture. They further maintain all operational tasks to ensure that the QRadar solution performs according to the key performance indicators.

Operational Tasks

These courses teach you how to perform operational tasks for your QRadar environment.

Deploy Changes in QRadar

Using QRadar SIEM License Management

QRadar License Management event and flow processing capacity

License Management in QRadar SIEM

Index Management in IBM Security QRadar SIEM

Aggregated Data Management in IBM Security QRadar SIEM

QRadar foundations - Data retention

QRadar Log Source Management app 7.0

QRadar Log Source Management App - Webinar

QRadar SIEM Log Source Custom Properties

Configuring the QRadar log source parsing order

Configuring Log File log sources for QRadar

Managing Disconnected Log Collectors with the QRadar Log Source Management app

How to add an App Host to QRadar SIEM

Planning your migration from QRadar App Node to App Host

Adding a QNI appliance to the QRadar deployment

Setting up a QRadar Network Insights appliances stack

How to use IBM X-Force Threat Intelligence and integrate with QRadar SIEM

QRadar SIEM Operational Tasks

Using QRadar SIEM backup management

Deploying managed QRadar WinCollect agents

QRadar Software Updates and Best Practice Admin Checklist - Open Mic

QRadar upgrades best practices - Open Mic

QRadar Sysmon and Windows Endpoint Detection - Open Mic

Maintaining QRadar 101 - Open Mic

Keeping QRadar up-to-date

Deployment resilience and high availability for QRadar

Academy Service Level Agreement and Contacts

DevOps

These courses teach you how to implement extensions and enhancements in your QRadar environment.

Determining indicators for threat detection with QRadar SIEM

Managing Custom Rules in QRadar SIEM

Developing Custom Rules in IBM QRadar SIEM

Local versus global rules in QRadar SIEM

Overview of Building Blocks in QRadar SIEM

How to configure rule actions in QRadar SIEM

Using host definition and host reference building blocks in QRadar SIEM

How to locate rules that triggered in QRadar SIEM

Developing efficient rules in QRadar SIEM

Using the Rule Explorer in the QRadar Use Case Manager app

Investigating anomalies by understanding Anomaly Rules in QRadar

Developing Anomaly Detection Rules in IBM QRadar SIEM

QRadar reference data collections use cases

Introduction to Custom Action Scripts

QRadar SIEM Integration & Extension

Creating custom log sources in QRadar SIEM

Log source autodetection and properties with the QRadar DSM Editor

Creating custom log sources using the DSM Editor

Configuration and benefits of an AWS log source in QRadar

Configuring and testing AWS CloudTrail log source with SQS queue in QRadar

Utilizing the Log Event Extended Format (LEEF) in QRadar

QRadar log sources - General configuration tips

Creating an offense for monitoring an internal log source in QRadar

Protect against ransomware using Guardium Data Encryption and QRadar

QRadar Use Case Manager Overview

QRadar Use Case Manager - New Features

QRadar Use Case Manager v2.2 + v2.3 Updates

QRadar Use Case Manager v2.3 Updates

Creating reports in QRadar SIEM

QRadar SIEM API

Let's talk about the QRadar app development framework V2 - Open Mic

QRadar App Framework SDK V2

QRadar Troubleshooting - Overview

Troubleshooting

These courses teach you how to perform basic troubleshooting tasks in your QRadar environment.

QRadar Troubleshooting - Tools

Getting started with QRadar Deployment Intelligence

QRadar WinCollect Troubleshooting - Open Mic

Developing efficient rules in QRadar SIEM

Considering QRadar rule capacity determined by performance analysis

How to update the QRadar network hierarchy to prevent false positive offenses

QRadar Tuning Part 1 - Overview and Networking

Tuning

These courses teach you how to perform basic tuning tasks in your QRadar environment.

QRadar Tuning Part 2 - Assets, Rules, and False Positives

QRadar Tuning - Open Mic

Tuning QRadar using the Use Case Manager App

QRadar Advanced Searches and Dashboards virtual lab

Click roadmap title to expand/collapse roadmap

QRadar SIEM Analyst

The total time required to complete this roadmap is 48h 24m.

QRadar SIEM Analysts are responsible for monitoring security incidents, investigating security event log information and network flows, scheduling vulnerability scanning, and coordinating remediation activities.

Investigations

These courses teach you how to investigate and remediate security threats in your IT environment Operational Tasks

Using IBM QRadar SIEM

QRadar SIEM Investigation - Working with Offenses

Using search efficiently in QRadar

Searching your QRadar data efficiently - Open Mic

QRadar SIEM Integration & Extension

Investigate cybersecurity threats using QRadar Analyst Workflow virtual lab

Using AQL for Advanced Searches in IBM QRadar SIEM

How to perform Network Analysis using QRadar SIEM Dashboard Items

QRadar Network Visibility Content Extension

QRadar Detecting Ransomware, Phishing and Malware

Protect against ransomware using Guardium Data Encryption and QRadar

Investigating anomalies by understanding Anomaly Rules in QRadar

How to configure rule actions in QRadar SIEM

QRadar Use Case Manager app overview

Advanced Search and Use Cases

QRadar SIEM Advanced Investigation & Use Cases

QRadar SIEM Advanced Investigation for Windows - Sysmon Use Cases

Creating reports in QRadar SIEM

Domain Generation Algorithm detection with QRadar DNS Analyzer

Domain squatting detection with QRadar DNS Analyzer

Filtering DNS traffic with QRadar DNS Analyzer

Creating an offense for monitoring an internal log source in QRadar

Sizing and scoping your QRadar deployment - Open Mic

Click roadmap title to expand/collapse roadmap

QRadar SIEM Architect

The total time required to complete this roadmap is 16h 34m.

QRadar SIEM Architects work in unison with IT Security Architects in an organization to design the holistic QRadar deployment architecture by integrating important log sources, network flows, assets, and user population.

Operational Tasks

These courses teach you how to perform operational tasks for your QRadar environment.

QRadar License Management event and flow processing capacity

QRadar Sysmon and Windows Endpoint Detection - Open Mic

QRadar SIEM Integration & Extension

DevOps

These courses teach you how to implement extensions and enhancements in your QRadar environment.

Determining indicators for threat detection with QRadar SIEM

Developing Custom Rules in IBM QRadar SIEM

Local versus global rules in QRadar SIEM

Overview of Building Blocks in QRadar SIEM

QRadar Architectural patterns for Managed Security Service Providers

Click roadmap title to expand/collapse roadmap

Managed Security Service Providers (MSSP)

The total time required to complete this roadmap is 5h 35m.

This roadmap depicts enablement assets for Managed Security Service Providers (MSSP). In addition to this roadmap, MSSPs should consider the assets that are provided in the QRadarFundamentals roadmap.

MSSP Foundation

These courses provide you with MSSP-related content covering concepts and architecture.

Using the IBM Disconnected Log Collector to collect and forward logs to QRadar

Managing Disconnected Log Collectors with the QRadar Log Source Management app

QRadar on Cloud architecture

Domain and Tenant Management for QRadar

Using domains and tenants in QRadar

QRadar domains and tenants - Open Mic

QRadar foundations - user management

QRadar UBA - multitenant environment setup

Apps integration

These courses cover the extensibility of the QRadar platform by deploying additional apps, with special emphasis for MSSPs.

QRadar UBA - multitenant environment setup lab

IBM Security QRadar SIEM Foundations

This is a commercial course (BQ104G) taught by IBM's network of Global Training Providers. To enroll in the course, follow the "View enrollment options" link to the IBM Training site to find a class that matches your location and schedule needs.

IBM Security QRadar enables deep visibility into network, endpoint, user, and application activity. It provides collection, normalization, correlation, and secure storage of events, flows, assets, and vulnerabilities. Suspected attacks and policy breaches are highlighted as offenses. In this course, you learn about the solution architecture, how to navigate the user interface, and how to investigate offenses. You search and analyze the information from which QRadar concluded a suspicious activity. Hands-on exercises reinforce the skills learned. This course is based on IBM Security QRadar 7.4.1.

Objectives

Describe how QRadar collects data to detect suspicious activities
Describe the QRadar architecture and data flows
Navigate the user interface
Define log sources, protocols, and event details
Discover how QRadar collects and analyzes network flow information
Describe the QRadar Custom Rule Engine (CRE)
Use the Use Case Manager app
Discover and manage asset information
Learn about a variety of QRadar apps, content extensions, and the App Framework
Analyze offenses by using the QRadar UI and the Analyst Workflow app
Search, filter, group, and analyze security data
Use AQL for advanced searches
Use QRadar to create customized reports
Explore aggregated data management
Define sophisticated reporting using Pulse Dashboards
Discover QRadar administrative tasks

24h Foundational

IBM QRadar SIEM Advanced Topics

IBM QRadar enables you to minimize the time gap between when a suspicious activity occurs and when you detect it. Attacks and policy violations leave their footprints in log events and network flows of your IT systems. To connect the dots, QRadar SIEM correlates these scattered events and flows into offenses that alert you to suspicious activities. Using the skills taught in this course, you will be able to thoroughly understand and configure QRadar rules, work with reference data, and create and manage uncommon log sources.

Objectives

Create and manage uncommon log source types
Leverage reference data collections
Develop and manage custom rules
Develop and manage custom action scripts
Develop and manage anomaly detection rules

This is a commercial course (BQ203) taught by IBM's network of Global Training Providers.

10m Advanced

IBM QRadar SIEM Foundations

IBM QRadar SIEM provides deep visibility into network, user, and application activity. It provides collection, normalization, correlation, and secure storage of events, flows, assets, and vulnerabilities. Suspected attacks and policy breaches are highlighted as offenses. In this course, you learn to navigate the user interface and how to investigate offenses. You search and analyze the information from which QRadar SIEM concluded a suspicious activity. Hands-on exercises reinforce the skills learned.

Objectives:

Describe how QRadar SIEM collects data to detect suspicious activities
Describe the QRadar SIEM component architecture and data flows
Navigate the user interface
Investigate suspected attacks and policy breaches
Search, filter, group, and analyze security data
Investigate the vulnerabilities and services of assets
Use network hierarchies
Locate custom rules and inspect actions and responses of rules
Analyze offenses created by QRadar SIEM
Use index management
Navigate and customize the QRadar SIEM dashboard
Use QRadar SIEM to create customized reports
Use charts and filters
Use AQL for advanced searches
Analyze a real world scenario

This is a commercial course (BQ103) taught by IBM's network of Global Training Providers.

10m Intermediate

IBM Security QRadar SIEM Foundations