Investigating overall user activity

Track configuration changes that users make on the system, such as a drop in event rates or an increase in new offenses.

Example: Investigating a drop in event rate
Use the System Overview page to view details about a drop in events and searches that were made by users. On the System Overview page, you notice a drop in events and some searches that were executed during the same time frame. You decide to investigate further by completing the following steps:
Example: Investigating a spike in offenses
View details about an increase in new offenses over time. On the System Overview page, you notice a spike in new offenses and some activity events that occurred during the same time frame.
Example: Investigating maximum offenses reached
View details about a maximum number of offenses notification. On the System Overview page, you find that the maximum number of offenses is reached. The notification might be the result of a rule that was added or modified.

Parent topic: QRadar Operations app