Optimizing your QRadar system

To get the best results in QRadar® Advisor with Watson™, you can optimize IBM® QRadar by reviewing the custom mapping configuration and reviewing log sources that are used by QRadar Advisor with Watson.

1. On the navigation menu ( ), click Admin.
2. In the Apps section, under QRadar Advisor with Watson, click Configuration.
3. Click Optional Settings to open the Optional Settings menu page.
4. Click Optimization.
5. Click Run Report.
6. By default, the sum of the events that have mapped properties and are also in offenses is enabled. Click In offenses to disable the toggle and show all events that have mapped properties but aren't necessarily in offenses.
7. Review the log sources and verify that all of the expected log sources are present. If a log source is not listed or does not have a substantial number of events that are used by QRadar Advisor with Watson, then it indicates that more mappings are required.
   
8. In the Property Mapping section, review any custom properties that were added or modified since the configuration wizard was last run.
   If you have any properties that are not yet mapped, they are listed.
9. Click the icon next to the property that you want to map for the app to use.
10. Select a canonical name from the list and then click Add.
    
11. Click Complete.