Discover and read the best of Twitter Threads about #qradartips
Most recents (1)
Hey for all you #infosec friends stuck with #ibm #qradar just like me, just remember it’s still better than having no #siem at all. Here is my contribution to the community, a mega thread of qradar tips to improve your life
#qradartips
0/N
#qradartips
0/N
Qradar Tip #1
equals is case sensitive
username equals 'neonprimetime'
will not find 'Neonprimetime'
(notice the capital N)
from the GUI use contains to be case insensitive!
#qradartips 1/N
equals is case sensitive
username equals 'neonprimetime'
will not find 'Neonprimetime'
(notice the capital N)
from the GUI use contains to be case insensitive!
#qradartips 1/N
Qradar Tip #2
avoid using the GUI for filtering
instead teach yourself AQL
use the "Advanced Search" drop down
it's a powerful SQL-like language
that will allow you to performance tune queries
use complex boolean logic
and much more!
ibm.com/support/knowle…
#qradartips 2/N
avoid using the GUI for filtering
instead teach yourself AQL
use the "Advanced Search" drop down
it's a powerful SQL-like language
that will allow you to performance tune queries
use complex boolean logic
and much more!
ibm.com/support/knowle…
#qradartips 2/N
