Security / Technical Security

IBM Security QRadar SIEM Administration.

IBM Security QRadar SIEM enables you to minimize the time gap between the occurrence of suspicious activity and its detection. There are many administrative tools you can use to manage your QRadar SIEM deployment. This course covers system configuration, data source configuration, and remote network and service configuration.

Issues

Installing and managing automatic updates to QRadar SIEM resources
Configure QRadar backup and restore policies
Use of QRadar administrative tools to aggregate, view and interpret metrics
Using network hierarchy objects to manage QRadar SIEM objects and groups
QRadar host and license management and resource deployment
Monitoring the status of resources in a QRadar deployment
Configure system settings and resource profiles
Configure reasons for QRadar administrators to close offenses
Creation and management of reference sets
Create credentials used to perform authenticated scans
Management, routing and storage of event data and flows
Using domains in QRadar SIEM to act as a filter for events, flows, scanners, resources, rules, violations and storage policies
Configuration of user accounts, including user profiles, authentication and authorization
Manage custom properties of resources, events and flows
QRadar log source management
QRadar flow source management
Integration of Vulnerability Assessment Scanner results into QRadar SIEM
Managing groups that monitor networks and Internet services

Who is this training for?

The course is designed for QRadar SIEM administrators and professional services personnel managing QRadar SIEM deployments

Prerequisites

Basic knowledge of the purpose and application of the security intelligence platform
Familiarity with the Linux command line interface and PuTTY
Knowledge of custom rules
Knowledge of the Ariel database and its purpose in QRadar SIEM
Students should have attended BQ102G, IBM Security QRadar Foundations training or be able to navigate and use the QRadar SIEM console

Training program

QRadar SIEM automatic resource updates — installation, configuration and auto-update management
QRadar backup configuration — backup policies, schedules, restoration, best practices
Network hierarchy — network hierarchy objects for managing QRadar SIEM objects and groups
Host and license management — resource deployment, status monitoring, resource profile configuration
System settings configuration — resource profiles, offense closure reasons, reference sets
Exercises: backup configuration, network hierarchy, host and license management

QRadar log source management — configuration, parsing, routing, custom event properties
Flow source management — flow source configuration, flow data routing and storage
Domains in QRadar SIEM — filtering events, flows, scanners, resources, rules, offenses and retention policies
User account configuration — profiles, authentication, authorization, permissions management
Vulnerability Assessment integration — VA scanner configuration, integrating results into QRadar SIEM
Exercises: configuring log and flow sources, domains, users, VA scanner integration

Delivery Methods

Online

Convenience of participating from anywhere
Interactive live sessions with trainer
Materials available for 30 days
No travel costs

On-site

Direct contact with trainer and group
Intensive hands-on workshops
Networking with other participants
Full focus on learning

Frequently asked questions

What are the prerequisites for this training?

For IBM Security QRadar SIEM Administration. we recommend: Basic knowledge of the purpose and application of the security intelligence platform; Familiarity with the Linux command line interface and PuTTY; Knowledge of custom rules.

What is the format and duration of this training?

The training lasts 2 days and is available in online and on-site format. Sessions run from 9:00 AM to 4:00 PM. We can also customize the schedule to fit your team's needs.

Who is this training designed for?

This training is designed for: The course is designed for QRadar SIEM administrators and professional services personnel managing QRadar SIEM deployments.