QRadar tuning

You can tune IBM QRadar to meet the needs of your environment.

Before you tune QRadar, wait one day to enable QRadar to detect servers on your network, store events and flows, and create offenses that are based on existing rules.

Administrators can do the following tuning tasks:

• Optimize event and flow payload searches by enabling a payload index on the Log Activity and Network Activity.
• Provide a faster initial deployment and easier tuning by automatically or manually adding servers to building blocks.
• Configure responses to event, flow, and offense conditions by creating or modifying custom rules and anomaly detection rules.
• Ensure that each host in your network creates offenses that are based on the most current rules, discovered servers, and network hierarchy.