Use cases and user personas

You can use the IBM® Security QRadar® Network Visibility dashboards for threat hunting and alert training, and to gain insights into the network traffic in the environment. Use the dashboards for investigating network traffic or as a reference point for overall network behavior.

Network traffic provides a rich source of information that you can use to detect a vast range of cyberattacks in any environment. The widgets on each of the three dashboards target a number of different use cases. Many of these use cases align with MITRE ATT&CK tactics and techniques. The following table describes some of the examples:

Table 1. Use case examples
Use cases MITRE ATT&CK tactics and techniques
Initial Access Spear Phishing, External Remote Services and more.
Execution Exploitation for Client Execution, User Execution and more.
Persistence Port Knocking, Create Account and more.
Defense Evasion Masquerading, Obfuscated Files or Information and more.
Credential Access Network Sniffing, Brute Force and more.
Discovery Remote System Discovery, Network Service Scanning and more.
Lateral Movement SSH Hijacking, Remote File Copy and more.
Collection Automated Collection, Data from Network Shared Drive and more.
Command and Control Uncommonly Used Port, Data Obfuscation and more
Exfiltration Exfiltration Over Alternative Protocol, Data Transfer Size Limits and more.
Impact Network Denial of Service, Resource Hijacking and more.

For more information about the tactics and techniques, see MITRE ATT&CK (