Release of QRadar 7.5.0 Update Package 15 ISO (2021.6.15.20260306120301)

Enhancements to Tiered Storage

Tiered Storage has been significantly enhanced to improve performance and reliability during data migrations and rebalancing. The update introduces faster re-indexing with concurrency, smarter error handling, and automatic recovery from interruptions. Administrators can now bulk edit policies through both the UI and API, receive real-time notifications for ongoing operations, and view detailed status banners for better visibility. Additional safeguards protect Hot Tier disk space, and per-cluster policies provide granular control over storage configurations. These improvements make managing large-scale storage environments more predictable and efficient, ensuring better control and resource optimization.

Multiple Log Source Identifiers

Users with the appropriate permissions to edit a log source can now configure multiple identifiers for that log source. This provides greater flexibility when device hostnames, IP addresses, or other identifiers change during activities such as migrations. By allowing additional identifiers to be manually associated with an existing log source, this enhancement helps prevent duplicate entries and improves log source management.

Important clarifications:

• No automatic changes after UP15: Updating to UP15 will not automatically modify any existing log sources in QRadar.

• No automatic merging: The feature does not automatically add or combine identifiers. All additional identifiers must be manually configured by users with the appropriate permissions.

• No multi‑identifier auto discovery: Auto discovered log sources will not be assigned multiple identifiers automatically.

• Planned migrations: To maintain continuous log collection during activities like hostname changes, users should manually add new identifiers ahead of time to the existing log source.

   This capability provides more flexibility and control in complex deployments, reduces the risk of duplicate log sources, and supports uninterrupted log ingestion during planned transitions.

Backup Generation and Restore with Digital Signature
 

Backup Generation and Restore with Digital Signature adds a secure process for creating and restoring backups with cryptographic validation. Beginning with this release, all new backups are automatically signed using the host’s private key and verified during restoration with the corresponding trusted public key. This ensures each backup’s authenticity and integrity, reducing the risk of data corruption, tampering, or unauthorized changes. The feature scales across all QRadar deployments after upgrade, aligning fully with the existing backup and restore framework. It also improves disaster recovery by enabling verified, trusted transfers across paired sites, helping minimize downtime and protect critical data. These enhancements strengthen security, support compliance, and provide greater confidence in overall system integrity. With this update, organizations gain a scalable and trusted backup solution that meets both regulatory and operational needs.

Improved AQL Error Handling and Indexed Field Visibility in Ariel API

This release strengthens AQL query handling with improved error reporting and visibility into indexed fields. The Ariel API now includes the “is indexed” property accessible through the endpoint GET /ariel/databases/{database_name}, enabling users to identify indexed fields for optimized query performance. Enhanced syntax error detection pinpoints issues and their exact location, reducing troubleshooting time.

Custom Rule Engine (CRE) Versioning and History

The rule versioning enhancements improve QRadar’s rule management by adding advanced version tracking and comparison capabilities. Users can now compare any two rule versions, capture detailed commit messages, and maintain accurate version history for user and modified rules. UI refinements and permission-based controls ensure a smoother experience and restrict actions to authorized users. Dependency checks help prevent misconfigurations during rule reverts, reducing operational risk. These improvements simplify troubleshooting and rollback processes, making rule management more efficient and reliable.

JA4 Fingerprinting in QNI

QRadar Network Insights (QNI) now supports JA4 fingerprinting for TLS traffic, enabling advanced analysis of encrypted sessions without exposing sensitive handshake details. This feature uses hash-based fingerprints to identify anomalous clients and detect unusual patterns in TLS communications. By improving detection accuracy while maintaining privacy, JA4 fingerprinting strengthens threat analysis workflows and aligns with modern security practices for encrypted traffic monitoring.

Improve locking scalability in DomainizedStorage2 for up to 50x speedup in search when using reference data filters

Search performance when searching events and flows using Reference Data filters was significantly improved by up to 50 times. The maximum benefit is achieved on systems where the storage system performance allows it, such as QRadar 1648 appliances.