Deployment tuning phase
In the deployment phase, you configure essential network, scanner, log source, and asset
configurations that are required to tune IBM
QRadar . The deployment phase is
done close to start, after you install, and configure QRadar and it is
operational.
Network hierarchy
QRadar SIEM user vulnerability assessment (VA) information to determine offense threat
levels and remove false positives, by correlating event data, network activity, and behavioral
changes.
VA scanners
QRadar SIEM user vulnerability assessment (VA) information to determine offense threat
levels and remove false positives, by correlating event data, network activity, and behavioral
changes.
DSM updates
QRadar SIEM uses Device Support Modules (DSMs) to log and correlate the data that is
collected from external log sources, such as firewalls, switches, or routers.
Log source detection
QRadar SIEM automatically detects log sources that send syslog messages to an Event
Collector.
Flow sources
Flow information is used to detect threats and activity that would otherwise be missed by
relying only on event information.
Asset profile configuration
QRadar SIEM automatically discovers the assets on your network, which are based on
passive QFlow data and vulnerability data. QRadar SIEM then builds an asset profile that displays
the services running on each asset.