Канал: Detections XYZ

QRadar Rule Manager

QRadar Rule Manager

Section 13 - Working with the QRadar Console - Lecture 1: Connecting to the Console

Section 13 - Working with the QRadar Console - Lecture 1: Connecting to the Console

Section 16 - End - Course End

Section 16 - End - Course End

Section 12 - Troubleshooting - Lecture 3:Troubleshooting Service Performance

Section 12 - Troubleshooting - Lecture 3:Troubleshooting Service Performance

Section 8 - Accuracy Tuning - Lecture 3: X-Force Integration

Section 8 - Accuracy Tuning - Lecture 3: X-Force Integration

Section 10 - Reporting, Searching & Offense Management - Lecture 4: Sharing Content Among Users

Section 10 - Reporting, Searching & Offense Management - Lecture 4: Sharing Content Among Users

Section 13 - Working with QRadar Console - Lecture 6: Reverting SSL Certificate to Locally Signed

Section 13 - Working with QRadar Console - Lecture 6: Reverting SSL Certificate to Locally Signed

Section 13 - Working with the QRadar Console - Lecture 3: Troubleshooting Services

Section 13 - Working with the QRadar Console - Lecture 3: Troubleshooting Services

Section 9 - User Management - Lecture 4: Authentication & Authorization

Section 9 - User Management - Lecture 4: Authentication & Authorization

Section 10 - Reporting, Searching & Offense Management - Lecture 1: Managing Reports

Section 10 - Reporting, Searching & Offense Management - Lecture 1: Managing Reports

Section 15 - Practical Use Cases - Lecture 4: Alerting on Disk Usage Exceeded Threshold

Section 15 - Practical Use Cases - Lecture 4: Alerting on Disk Usage Exceeded Threshold

Section 7 - Data Source Configuration - Lecture 1: Xpath Queries

Section 7 - Data Source Configuration - Lecture 1: Xpath Queries

Section 14 - Working with the API - Lecture 2: Python Script with QRadar API Example

Section 14 - Working with the API - Lecture 2: Python Script with QRadar API Example

Section 15 - Practical Use Cases - Lecture 9: Working with QRadar Deployment Intelligence

Section 15 - Practical Use Cases - Lecture 9: Working with QRadar Deployment Intelligence

Section 15 - Practical Use Cases - Lecture 1: Alerting on non-reporting Log Sources

Section 15 - Practical Use Cases - Lecture 1: Alerting on non-reporting Log Sources

Section 10 - Reporting, Searching & Offense Management - Lecture 2: Different Types of Searches

Section 10 - Reporting, Searching & Offense Management - Lecture 2: Different Types of Searches

Section 8 - Accuracy Tuning - Lecture 2: Verifying GeoIP Changes

Section 8 - Accuracy Tuning - Lecture 2: Verifying GeoIP Changes

Section 7 - Data Source Configuration - Lecture 8: Custom Event Properties

Section 7 - Data Source Configuration - Lecture 8: Custom Event Properties

Section 15 - Practical Use Cases - Lecture 2: Alerting on non-reporting Domains

Section 15 - Practical Use Cases - Lecture 2: Alerting on non-reporting Domains

Section 13 - QRadar Console - Lecture 4: Troubleshooting Event Processor Connectivity and Rate

Section 13 - QRadar Console - Lecture 4: Troubleshooting Event Processor Connectivity and Rate

Section 13 - Working with the QRadar Console - Lecture 5: Deploying Changes Directly from Console

Section 13 - Working with the QRadar Console - Lecture 5: Deploying Changes Directly from Console

Section 11 - Tenants & Domains - Lecture 3: Monitoring License Usage

Section 11 - Tenants & Domains - Lecture 3: Monitoring License Usage

Section 12 - Troubleshooting - Lecture 2: Troubleshooting Applications

Section 12 - Troubleshooting - Lecture 2: Troubleshooting Applications

Section 10 - Reporting, Searching & Offense Management - Lecture 3: Offenses Management

Section 10 - Reporting, Searching & Offense Management - Lecture 3: Offenses Management

Section 7 - Data Source Configuration - Lecture 2: Log Source Management

Section 7 - Data Source Configuration - Lecture 2: Log Source Management

Section 15 - Practical Use Cases - Lecture 8: Working with Threat Intelligence

Section 15 - Practical Use Cases - Lecture 8: Working with Threat Intelligence

Section 11 - Tenants & Domains - Lecture 1: Differentiating Network Hierarchy and Domain Definition

Section 11 - Tenants & Domains - Lecture 1: Differentiating Network Hierarchy and Domain Definition

Section 9 - User Management - Lecture 2: User Roles

Section 9 - User Management - Lecture 2: User Roles

Section 7 - Data Source Configuration - Lecture 7: Custom AQL Properties

Section 7 - Data Source Configuration - Lecture 7: Custom AQL Properties

Section 7 - Data Source Configuration - Lecture 5: Exporting Event Data

Section 7 - Data Source Configuration - Lecture 5: Exporting Event Data

Section 15 - Practical Use Cases - Lecture 3: Dealing with Disabled Custom Properties

Section 15 - Practical Use Cases - Lecture 3: Dealing with Disabled Custom Properties

Section 12 - Troubleshooting - Lecture 1: Responding to and Dealing with System Notifications

Section 12 - Troubleshooting - Lecture 1: Responding to and Dealing with System Notifications

Section 15 - Practical Use Cases - Lecture 6: DSM "Failed to Load Data" Error

Section 15 - Practical Use Cases - Lecture 6: DSM "Failed to Load Data" Error

Section 8 - Accuracy Tuning - Lecture 1: MaxMind GeoIP

Section 8 - Accuracy Tuning - Lecture 1: MaxMind GeoIP

Section 7 - Data Source Configuration - Lecture 4: Log Source Groups

Section 7 - Data Source Configuration - Lecture 4: Log Source Groups

Section 14 - Working with the API - Lecture 1: QRadar API Basics

Section 14 - Working with the API - Lecture 1: QRadar API Basics

Section 15 - Practical Use Cases - Lecture 7: Creating Useful Dashboards with Pulse

Section 15 - Practical Use Cases - Lecture 7: Creating Useful Dashboards with Pulse

Section 13 - Working with the QRadar Console - Lecture 2: Running AQL inside the Console

Section 13 - Working with the QRadar Console - Lecture 2: Running AQL inside the Console

Section 13 - Working with the QRadar Console - Lecture 7: Deleting a Rule Directly from the Console

Section 13 - Working with the QRadar Console - Lecture 7: Deleting a Rule Directly from the Console

Section 6 - Performance Optimization - Lecture 2: Resource Restrictions

Section 6 - Performance Optimization - Lecture 2: Resource Restrictions

Section 7 - Data Source Configuration - Lecture 3: Event Coalescing

Section 7 - Data Source Configuration - Lecture 3: Event Coalescing

Section 7 - Data Source Configuration - Lecture 6: Custom Log Sources Event Mappings

Section 7 - Data Source Configuration - Lecture 6: Custom Log Sources Event Mappings

Section 15 - Practical Use Cases - Lecture 10: Mandatory Steps after Upgrading Console CPU

Section 15 - Practical Use Cases - Lecture 10: Mandatory Steps after Upgrading Console CPU

Section 9 - User Management - Lecture 3: Security Profiles

Section 9 - User Management - Lecture 3: Security Profiles

Section 11 - Tenants & Domains - Lecture 2: Tenants and Domains

Section 11 - Tenants & Domains - Lecture 2: Tenants and Domains

Section 15 - Practical Use Cases - Lecture 11: Logs are being Truncated / Split

Section 15 - Practical Use Cases - Lecture 11: Logs are being Truncated / Split

Section 11 - Tenants & Domains - Lecture 4: Assigning Tenant to User

Section 11 - Tenants & Domains - Lecture 4: Assigning Tenant to User

Section 6 - Performance Optimization - Lecture 1: Index Management

Section 6 - Performance Optimization - Lecture 1: Index Management

Section 15 - Practical Use Cases - Lecture 5: Alerting on Dropped Events

Section 15 - Practical Use Cases - Lecture 5: Alerting on Dropped Events

Section 6 - Performance Optimization - Lecture 3: Routing Rules

Section 6 - Performance Optimization - Lecture 3: Routing Rules

Section 9 - User Management - Lecture 1: Managing Users

Section 9 - User Management - Lecture 1: Managing Users

Section 1 - Introduction & Installation - Lecture 3: Installing QRadar

Section 1 - Introduction & Installation - Lecture 3: Installing QRadar

Section 3 - Rules - Lecture 8: Translating Threat Report to Rules

Section 3 - Rules - Lecture 8: Translating Threat Report to Rules

Section 3 - Rules - Lecture 3: Troubleshooting Rules

Section 3 - Rules - Lecture 3: Troubleshooting Rules

Section 1 - Introduction & Installation - Lecture 4: Introduction to QRadar

Section 1 - Introduction & Installation - Lecture 4: Introduction to QRadar

Section 1 - Introduction & Installation - Lecture 5: Ingesting Events Windows

Section 1 - Introduction & Installation - Lecture 5: Ingesting Events Windows

Section 4 - Working with Reference Data - Lecture 1: Different Types of Reference Data

Section 4 - Working with Reference Data - Lecture 1: Different Types of Reference Data

Section 5 - System Configuration - Lecture 4: Event Retention

Section 5 - System Configuration - Lecture 4: Event Retention

Section 5 - System Configuration - Lecture 2: Network Hierarchy

Section 5 - System Configuration - Lecture 2: Network Hierarchy

Section 3 - Rules - Lecture 0: Requirements for app installs

Section 3 - Rules - Lecture 0: Requirements for app installs

Section 4 - Working with Reference Data - Lecture 4: Dealing with Massive amounts of Reference Data

Section 4 - Working with Reference Data - Lecture 4: Dealing with Massive amounts of Reference Data

Section 3 - Rules - Lecture 5: Finding Expensive Rules

Section 3 - Rules - Lecture 5: Finding Expensive Rules

Section 2 - QRadar overview - Lecture 2: Log Activity basic searching

Section 2 - QRadar overview - Lecture 2: Log Activity basic searching

Section 5 - System Configuration - Lecture 1: Managed Hosts

Section 5 - System Configuration - Lecture 1: Managed Hosts

Section 2 - QRadar overview - Lecture 1: User Interface

Section 2 - QRadar overview - Lecture 1: User Interface

Section 5 - System Configuration - Lecture 6: Custom Offense Email Templates

Section 5 - System Configuration - Lecture 6: Custom Offense Email Templates

Section 1 - Introduction & Installation - Lecture 6: Ingesting events from PfSense Firewall

Section 1 - Introduction & Installation - Lecture 6: Ingesting events from PfSense Firewall

Section 5 - System Configuration - Lecture 3: Auto updates

Section 5 - System Configuration - Lecture 3: Auto updates

Section 3 - Rules - Lecture 1: Use Case Manager, Rules and Building Blocks

Section 3 - Rules - Lecture 1: Use Case Manager, Rules and Building Blocks

Section 3 - Rules - Lecture 7: Practical Example Firewall Rules

Section 3 - Rules - Lecture 7: Practical Example Firewall Rules

Section 2 - QRadar overview - Lecture 3: QRadar Services

Section 2 - QRadar overview - Lecture 3: QRadar Services

Section 1 - Introduction & Installation - Lecture 2: Introduction to SIEM

Section 1 - Introduction & Installation - Lecture 2: Introduction to SIEM

Section 4 - Working with Reference Data - Lecture 3: Integrating Reference Data with Rules

Section 4 - Working with Reference Data - Lecture 3: Integrating Reference Data with Rules

Section 3 - Rules - Lecture 4: Optimizing Rules

Section 3 - Rules - Lecture 4: Optimizing Rules

Section 4 - Working with Reference Data - Lecture 2: Using Reference Data with default UI

Section 4 - Working with Reference Data - Lecture 2: Using Reference Data with default UI

Section 3 - Rules - Lecture 2: Using AQL Inside Rules

Section 3 - Rules - Lecture 2: Using AQL Inside Rules

Section 3 - Rules - Lecture 6: Practical Example SIGMA Rules

Section 3 - Rules - Lecture 6: Practical Example SIGMA Rules

Section 1 - Introduction & Installation - Lecture 1: Introduction

Section 1 - Introduction & Installation - Lecture 1: Introduction