IBM Security QRadar SIEM Users Guide

1 IBM Security QRadar SIEMV ersion Guide Note: Before using this information and the product that it supports, read the information in Notices and trademarks on page 341. Copyright IBM Corp. 2013 All Rights Reserved US Government Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM THIS GUIDEI ntended audience .. 1 Conventions .. 1 Technical documentation .. 1 Contacting customer support .. 11 ABOUT QRadar SIEMS upported web browsers .. 3 Logging in to QRadar SIEM .. 3 user interface tabs .. 4 Dashboard tab.

2 4 Offenses tab .. 5 Log Activity tab .. 5 Network Activity tab .. 5 Assets tab .. 5 Reports tab .. 5 IBM Security QRadar Risk Manager.. 6 IBM Security QRadar Vulnerability Manager .. 6 Admin tab .. 6 QRadar SIEM common procedures .. 7 Viewing messages .. 7 Sorting results .. 9 Refreshing and pausing the user interface .. 10 Investigating IP addresses .. 10 Investigating user names .. 12 System time .. 12 Updating user details .. 13 Accessing Online Help .. 13 Resizing columns .. 13 Configuring page size .. 132 DASHBOARD MANAGEMENTD ashboard overview.

3 15 Default dashboards.. 15 Custom dashboards .. 17 Available dashboard items .. 18 Flow search items .. 18 Offense items .. 19 Log Activity items.. 19 Most Recent Reports items .. 20 System Summary item .. 20 Risk Manager items.. 21 Vulnerability Management items .. 21 System Notifications item .. 22 Internet Threat Information Center .. 23 Dashboard management tasks.. 23 Viewing a dashboard .. 23 Creating a custom dashboard .. 23 Investigating log or network activity from a dashboard item .. 24 Configuring charts .. 25 Removing items.. 26 Detaching an item.

4 26 Renaming a dashboard .. 26 Deleting a dashboard .. 27 Managing system notifications .. 27 Adding search-based dashboard items to the Add Items list .. 273 OFFENSE MANAGEMENTO ffense overview .. 29 Offense permission considerations .. 29 Key terms .. 29 Offense retention .. 30 Offense monitoring .. 30 Monitoring the All Offenses or My Offenses pages .. 31 Monitoring offenses grouped by category .. 31 Monitoring offenses grouped by source IP .. 32 Monitoring offenses grouped by destination IP .. 32 Monitoring offenses grouped by network.

5 33 Offense management tasks .. 33 Adding notes .. 34 Hiding offenses .. 35 Showing hidden offenses .. 35 Closing offenses .. 35 Protecting offenses .. 36 Unprotecting offenses .. 37 Exporting offenses.. 37 Assigning offenses to Users .. 38 Sending email notification .. 39 Marking an item for follow-Up .. 40 Offense tab toolbar functions .. 41 Offense parameters .. 444 LOG ACTIVITY INVESTIGATIONLog Activity tab overview .. 65 Log Activity tab toolbar .. 65 Quick Filter syntax .. 68 Right-click menu options.. 69 Status bar .. 69 Log activity monitoring.

6 70 Viewing streaming events .. 70 Viewing normalized events .. 70 Viewing raw events .. 73 Viewing grouped events .. 74 Event details .. 78 Event details toolbar .. 81 Viewing associated offenses .. 81 Modifying event mapping .. 82 Tuning false positives.. 83 Managing PCAP data .. 84 Displaying the PCAP data column .. 84 Viewing PCAP information .. 85 Downloading the PCAP file to your desktop system.. 86 Exporting events .. 865 NETWORK ACTIVITY INVESTIGATIONN etwork Activity tab overview .. 89 Network Activity tab toolbar .. 89 Quick Filter syntax .. 92 Right-click menu options.

7 93 Status bar .. 94 OverFlow records .. 94 Network activity monitoring .. 94 Viewing streaming flows .. 94 Viewing normalized flows .. 95 Viewing grouped flows .. 98 Flow details .. 101 Flow details toolbar .. 103 Tuning false positives.. 104 Exporting flows.. 1056 CHART MANAGEMENTC harts overview .. 107 Time series chart overview .. 108 Chart legends.. 109 Configuring charts .. 1107 DATA SEARCHESE vent and flow Searches .. 113 Searching events or flows ..113 Saving event and flow search criteria ..118 Offense searches ..119 Searching offenses on the My Offenses and All Offenses pages.

8 119 Searching offenses on the By Source IP page .. 125 Searching offenses on the By Destination IP page .. 127 Searching offenses on the By Networks page .. 128 Saving search criteria on the Offense tab .. 129 Deleting search criteria.. 130 Performing a sub-search .. 130 Managing event and flow search results .. 131 Saving search results .. 132 Viewing managed search results .. 132 Canceling a search .. 134 Deleting a search result.. 134 Managing search groups .. 134 Viewing search groups .. 135 Creating a new search group .. 136 Editing a search group.

9 136 Copying a saved search to another group .. 137 Removing a group or a saved search from a group .. 1378 CUSTOM EVENT AND FLOW PROPERTIESC ustom property overview .. 139 Required permissions .. 139 Custom property types .. 139 Custom property management .. 140 Creating a regex-based custom property .. 140 Creating a calculation-based custom property .. 143 Modifying a custom property .. 144 Copying a custom property .. 146 Deleting a custom property .. 1469 RULE MANAGEMENTRule permission considerations .. 149 Rules overview .. 149 Rule categories.

10 149 Rule types .. 150 Rule conditions .. 151 Rule responses .. 151 Viewing rules .. 152 Creating a custom rule .. 153 Creating an anomaly detection rule .. 154 Rule management tasks.. 156 Enabling/disabling rules .. 156 Editing a rule .. 157 Copying a rule .. 157 Deleting a rule.. 158 Rule group management .. 158 Viewing a rule group .. 158 Creating a group .. 159 Assigning an item to a group .. 159 Editing a group .. 159 Copying an item to another group .. 160 Deleting an item from a group .. 160 Deleting a group .. 161 Editing building blocks.