Creating domains for VLAN flows

Use the Domain Management window to create domains based on IBM QRadar VLAN flow sources.

About this task

In QRadar, you can assign domains to incoming flows based on the VLAN information that is contained in the flow. The incoming flows are mapped to domains that contain the same VLAN definition.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Domain Management.
  3. Click Add and type a unique name and description for the domain.
    Tip: You can check for unique names by typing the name in the Input domain name search box.
    Figure 1. Input domain name
    Input domain name
  4. Click the Flows tab, and then select Flow VLAN IDs.
  5. Select the enterprise VLAN ID and Customer VLAN ID values that match the values on the incoming flows, and then click Add.
    Notes:
    • The Enterprise VLAN ID (IE): 82 is specified by Private Enterprise Number (PEN): 2, Information Element (IE) on incoming flows.
    • The Customer VLAN ID is specified by PEN: 2 and IE: 83 on incoming flows.
    Figure 2. New Domain
    New Domain
  6. In the Name field, type a unique name for the domain and then click Create.

Results

The domain definition is created and incoming flows are mapped. Tenant assignment to a domain occurs as normal.
Figure 3. Domain definition created
Domain definition created