Enabling or disabling document generation for specific protocols

In IBM QRadar Incident Forensics, the DNS and NetBIOS Name Service protocols do not generate documents by default. You can change this behavior by changing the document configuration settings for the protocol.

Procedure

  1. Using SSH, log in to the QRadar Console.
  2. Edit the /opt/qradar/conf/forensics.xml file.
  3. In the excludeInspectors section, add or remove the nodoc elements for any inspector that you want to disable document generation for.
    For example, to enable document generation for the DNS protocol, remove the <nodoc>dns</nodoc> line.

    To disable document generation for a specific protocol, add a line that matches the <nodoc>protocol_name</nodoc> format.

  4. Save the changes to the forensics.xml file.
  5. To push the configuration changes to all managed hosts, type this command: 
    /opt/qradar/support/all_servers.sh -p /opt/qradar/conf/forensics.xml -r /opt/qradar/conf
  6. Using a web browser, log in to the QRadar Console.
  7. On the Admin tab, click Advanced > Deploy Full Configuration.
    When the deployment is complete, the configuration changes apply to all future QRadar Incident Forensics recoveries and packet capture file uploads to cases.