Release of QRadar Incident Forensics 7.5.0 Update Package 12 ISO (2021.6.12.20250509154206)

Predictive Parsing Enhancements for Custom Event Properties
QRadar SIEM Predictive Parsing for Custom Event Properties

Enhanced Search Progress Visualization
The search visualization on the Log and Network Activity screen has been improved by replacing the previous circling animation with a dynamic progress bar. This update includes an estimated time to completion, calculated based on elapsed time and remaining percentage, providing users with a clearer view of the search execution speed.

Add Creation Date to offense summary page, and offense search page
In previous versions of QRadar, the offense summary page would show the offense start date, which is tied to the first event related to the offense. We have added the creation date, which indicates when the offense was created, typically after the start time.

Search Performance Improvement in Multi-Tenant Deployments with Reference Set Filters
Search performance is increased by up to 100 times or more in QRadar deployments with multi-tenancy, where Reference Set filters are used in search

Enhanced Log Search by Event Collector Name
Searching logs by event collector is now simplified by allowing the use of the new Event Collector field and the previous Event Collector ID in the user interface. This update offers a more intuitive search experience with an auto-populated list of Event Collector IDs dropdown of compatible values and operators, aligning with the search functionality used for other host criteria like Event Processor.

Improved Scattering with Absolute Space Thresholds on larger Data Nodes
Data Scattering, the process of distributing data across Data Nodes, has been improved to use absolute space thresholds, optimizing disk space utilization on larger Data Nodes. This change ensures more efficient disk space management by comparing available free space with calculated thresholds, allowing for storing more data without risk of shutdown.

Streamlined QRadar UI with Key Enhancements
Enhanced QRadar UI with updates to Auto Update, Network Hierarchy, Backup & Recovery, Index Management, Aggregated Data Management, System Health, System Settings, QVM Configuration, Routing Rules, Custom Offense Close Reasons, and Forwarding Destinations applications within the Admin tab.

Enhanced Search Progress Visualization
The search visualization on the Log and Network Activity screen has been improved by replacing the previous circling animation with a dynamic progress bar. This update includes an estimated time to completion, calculated based on elapsed time and remaining percentage, providing users with a clearer view of the search process.

The package DSM DSM-JuniperJunOS-7.5-20240628064229.noarch has been added.
To enhance the customer experience, this package should be pre-installed to ensure log parsing works seamlessly for Juniper customers, especially those in air-gapped environments where automatic updates are not available.
 
Updated Protocols: Common, UniversalCloudRESTAPI, TLSSyslog, BoxRESTAPI, and CertificateUtilsCommon
These protocols have been enhanced to ensure compatibility with Java 11 by implementing the necessary updates to meet Java 11 compliance requirements.
 
Updated Default AutoUpdate Version to 9.21
The enhanced AutoUpdate version 9.21 is now set as the default to provide support for Java 11 and PostgreSQL 16.
 
Released New DSM for Storage Protect: https://www.ibm.com/docs/en/dsm?topic=storage-protect 
 
Released New DSM for Azure Monitor Agent(AMA) for Linux: https://www.ibm.com/docs/en/dsm?topic=configuration-microsoft 

Released New Palo Alto Firewall PAN-OS Support
Parsing capabilities have been extended to support PAN-OS version 11.0, including DNS Security, FILE, Tunnel, and URL logs.

• https://www.ibm.com/docs/en/dsm?topic=series-palo-alto-pa-dsm-specifications
• https://www.ibm.com/docs/en/dsm?topic=configuration-qradar-supported-dsms
• https://www.ibm.com/docs/en/dsm?topic=panps-configuring-syslog-leef-formatted-events-your-palo-alto-pa-series-device

Protocol Cisco Duo Pagination Enhancement
Resolved an issue in the CiscoDuo Protocol where events were missed between two recurrences when the response contained more events than the limit defined by Cisco. This update implements pagination to ensure all events between recurrences are processed.