Release of QRadar Incident Forensics 7.5.0 Update Package 13 ISO (2021.6.12.20250718011446)

For more information on new and changed features in QRadar Incident Forensic 7.5.0, see What's new in 7.5.0.

Console-Only Failover support:

Optimized backup validation response time during Disaster Recovery (DR) site activation, especially in large environments with over 1000+ backups at the Primary site, reducing delays and improving recovery efficiency

Infographic-based visualization in Offense tab

• Introduced infographic-based visual summaries in the QRadar Offense tab, enhancing situational awareness through:
  • Timeline views of offenses to monitor activity trends.
  • Magnitude-based ranking to prioritize offenses effectively.
  • Host-based categorization to quickly identify targeted assets.
• Infographic-based visual insights enable analysts to investigate and respond to threats more efficiently.

Enhanced Admin tab with Unified Interfaces

• Consistent and streamlined user experience across:
  • Store and Forward
  • Domain Management
  • Centralized Credentials
  • Resource Restrictions
• This enhancement simplifies system configuration and management through a consistent interface design.

Console-Only Apps Failover - Enabled seamless application continuity in console-only workflow when apps are hosted on console. This enhancement is fully supported in appliance installations, ensuring uninterrupted availability of critical application services after console-specific failover and failback scenarios.

Custom properties - Ability to use multiple capture groups and literals in regex custom properties:
Multiple capture groups for custom properties gives customers the ability to use format strings and literal characters when defining a property which allows you to extract non continuous strings in the payload.

QRadar Host Monitoring via SNMPwalk -  Enabled SNMPv3 and created UI to support SNMP polling (snmpwalk) of QRadar appliances. SNMPv3 is a secure protocol and is now supported for QRadar host monitoring to comply with modern security standards and IBM’s “Secure by Design” and “Secure by Default” paradigms.

Enhanced Partial Search Results Visibility for Running Searches - The number of partial search results visible during active queries in Log Activity and Network Activity has been increased from 40 to up to 1000 entries. This enhancement provides greater visibility into long-running searches, enabling users to explore more data in real-time and identify potential filters to refine results while the query is still executing.

Disaster Recovery and Data Centre backup and restore processes - Improved efficiency and reliability.

DSM Editor Enhanced Capabilities - 

• Improved event parsing and mapping in F5 Networks, BIG-IP APM, VMware vCenter, Linux OS, McAfee ePolicy Orchestrator, and TLS Syslog
• Improved auto-population of Event ID and Event Category fields in the “Create a New Event Mapping” dialog
• Improved “Suggest Regex” feature for users with System Administrator capabilities

ERSPAN Traffic Support -  QRadar can now collect ERSPAN (Encapsulated Remote Switched Port Analyzer) traffic, which means it can see mirrored network data directly. This helps with:

1. Seamless Visibility into Remote and Virtual Environments
   ERSPAN enables QRadar to receive mirrored traffic from remote or virtual network segments over IP, providing deep visibility into environments where physical sensors are impractical. This allows customers to monitor hybrid and cloud infrastructures more effectively, ensuring consistent traffic analysis across the entire network.
2. Reduced Deployment Complexity and Cost
   By leveraging ERSPAN, customers can eliminate the need for dedicated packet capture appliances at every location. Network devices can send traffic directly to QRadar, simplifying the architecture and significantly lowering deployment and maintenance costs while speeding up time-to-value.
3. Improved Threat Detection and Network Forensics
   With ERSPAN traffic support, QRadar can perform detailed packet inspection and enrich flow records, enabling detection of threats that may bypass traditional flow analysis. This enhances customers’ ability to identify APTs, and policy violations, thereby strengthening security posture.

Improved MAC Address Visibility in QRadar for Smarter Threat Detection -  QRadar now reads MAC addresses in key flow types like QFlow, SFlow, and Packeteer. This helps with:

1. Enhanced Asset Identification and Correlation
By incorporating MAC addresses into all flow data—including third-party sources—QRadar can more accurately identify and track network assets, even when IP addresses change due to DHCP. This helps customers maintain a more reliable and persistent asset inventory, improve correlation accuracy, and reduce false positives in threat detection.

2. Improved Network Forensics and Lateral Movement Detection
MAC addresses provide a lower-layer identifier that’s harder to spoof than IP addresses. Including MAC data in all flows enables QRadar to trace device movements across subnets, detect unauthorized devices, and reconstruct attack paths with greater precision. This significantly enhances investigations and the detection of stealthy movement within the network.

 3. Verifiable device identity
With consistent MAC-level visibility, QRadar can better monitor policy enforcement in segmented networks and detect violations at the hardware level. This helps ensuring that device identity is verifiable and auditable, regardless of IP reassignment or obfuscation. 

Enhanced Asset APIs:

a) DELETE API.  The Delete Assets API is a fundamental feature that has been missing from QRadar for a long time. With this API, customers can integrate their environments (e.g., CMDB) to remove outdated assets and maintain synchronized data with the QRadar environment.
Whenever applications need to interact with the asset model, APIs are the only available method. Therefore, this API has strong potential to be utilized by applications in the future.

b) Extended GET API.  Product information is required for assets so that any consumer can identify the type of asset based on the data. UEBA will be a potential consumer of this extended API, using the product details to enrich the context of monitored entities. This provides analysts with a clearer view, helping them identify which operating system is associated with a specific entity.