Napatech interface

If you installed a Napatech Network Adapter on your IBM® QRadar® system, you can monitor the packets that the card sees. The Napatech card must be installed for QRadar to show it in the list of configurable packet-based flow sources.

After the flow source is configured and the changes are deployed, you can view the network traffic on the Network Activity tab. You can customize the way that QRadar processes the network traffic by changing the configuration settings, such as the application detection, superflow thresholds, flow direction configuration, and network hierarchy. You can also write rules, perform queries, and filter the network traffic.

For more information about the Napatech Network Adapter, see the Napatech documentation.