Investigating tuning findings

Sometimes, rules or building blocks might be incorrectly defined. Use the Tuning Finding report to investigate whether the rule or building block needs to be edited for more robust information, or if the rule is working as designed. Then, you can hide the finding if it’s not relevant (for example you set the rule up that way) or is a false positive.

About this task

IBM® QRadar® Use Case Manager detects the following findings and displays them in the report:
Disabled custom property
The rule references a disabled custom property. A custom property expression is disabled if the custom property expression has performance problems. Rules, reports, or searches that use this property, and which rely on the disabled expression to populate it, stop working properly.
Disabled dependency
Disabled rules prevent all the data from being detected, and stop the rest of the rule-dependent chain from triggering properly.
Empty reference set
A reference set contains unique values that you can use in searches, filters, rule test conditions, and rule responses. An empty reference set doesn’t have the criteria to trigger the rule properly.
Host definition uses only the default IP value
The host definition linked to the rule should not be the default value; otherwise, the rule won't work, because incoming logs use the IP addresses and host information that aren't the default value (127.0.0.1).
Host definition uses only the default value for destination IP
The destination IP that is linked to the rule should not be the default IP. If a content pack update changes any of the IP addresses in the rules, some dependent rules might not work. Go to the BB's Host Definition page to check each dependent.
Host definition uses only the default value for source IP
The source IP that is linked to the rule should not be the default IP. If a content pack update changes any of the IP addresses in the rules, some dependent rules might not work. Go to the BB's Host Definition page to check each dependent.
No original system rule
The rule has an Override origin but no linked original System rule, which can occur if the System rule is deleted by mistake. QRadar Use Case Manager cannot open the rule.
Orphaned building block
The building block has no dependents. Building blocks group commonly used tests and can contain important information about your organization. For example, you might create a building block that includes the IP addresses of all mail servers in your network, then use that building block in another rule to exclude those hosts. An orphaned BB is not referenced by any rules, which can result in important information that is excluded from searches. Delete the building block or reference it by another rule.
Rule uses performance-intensive tests that are not at the end of the test list.
Rule performance might not be optimal because the rule contains regex, payload, counter or sequence tests that are not at the end of the list. Make sure that these definitions are at the end of the test list so that they run only if all other tests in the list pass.
Rule performance may not be best when reference sets have too many elements.

On the Configuration page, set the number of reference set elements that trigger a finding if the number is exceeded. The default is 5000.

Procedure

  1. From the QRadar Use Case Manager main menu, click Tuning Finding Report.
  2. To scan for updated rule findings from IBM QRadar, click the Refresh findings report icon. It might take a few minutes to update the report.
    Tip: The scan results automatically update overnight. Update the rules manually when you make changes and you want to verify that they updated correctly in QRadar Use Case Manager.
  3. Sort the Tuning Finding column to investigate similar finding types together.
  4. To hide findings in the report, select the checkboxes for the relevant findings and click Hide findings.
    The selected tuning findings are flagged as hidden. When you hide a finding, the tuning findings don't appear in the rule details for the rule when you access it from any other report. Any warning icons for the rule are also hidden in other reports the rule might appear in.
  5. Fine-tune the view by showing or hiding the selected findings.
    Click Show hidden findings to see all the findings in the report.
  6. To clear the hidden flags from a finding so that you always see it in the report, click Show hidden findings. Select the checkboxes for the relevant findings, and then click Remove hidden flag.
    The hidden findings are updated to display in the report.
  7. Click the rule name to further investigate and edit if necessary on the Rule Details page. Full details appear in the Tuning Finding section.
    1. Click Edit in rule wizard to make your changes. For example, if a rule is enabled but a rule in its dependency tree is disabled, you can enable it in the rule wizard.
    2. Select the finding and click Hide findings.
    3. In the Tuning Finding report, click the refresh icon to update the report display.
  8. After you make your changes, refresh the report to see that your changes are implemented.