Hi,

I would like to ask please if Qradar is able to automatically delete IPs which have a good reputation from a reference set.

For exemple : I lately noticed that I legitimate IP still in the reference set and not deleted automatically whereas we are importing the collection from IBM XFE.

Regards,

------------------------------
Chawki Ben Salem
Security Operations Center Analyst
------------------------------

As I recall, there is no option (any more) to completely replace the content of the reference set. Good approach could be that the reference set has expiry time frame set for its items (say 3 months after they initially appeared ?). The problem, however, may lie also on the source side - public collections may not be curated/updated timely so there may be tendency to have stall data remaining in the collection.

------------------------------
Dusan VIDOVIC
------------------------------

Hi Dusan,

Thank you for your reply, as you said, defining TTL of data in the reference set might be a good solution. Otherwise, a custom python script might be good solution too.

Regards,

------------------------------
Chawki Ben Salem
Security Operations Center Analyst
------------------------------

Original Message:
Sent: Thu February 02, 2023 04:51 AM
From: Dusan VIDOVIC
Subject: Automatically delete good reputation's IPs from reference set

As I recall, there is no option (any more) to completely replace the content of the reference set. Good approach could be that the reference set has expiry time frame set for its items (say 3 months after they initially appeared ?). The problem, however, may lie also on the source side - public collections may not be curated/updated timely so there may be tendency to have stall data remaining in the collection.

------------------------------
Dusan VIDOVIC
------------------------------