IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Custom Use cases

    Posted Wed January 25, 2023 09:19 AM
    Edited by ahad Mon December 25, 2023 12:05 AM

    Is there a consolidated place where the community is collaboratively creating use case and posting them. i have always though it would make so much sense for it to be a thing but dont know if it already being done somewhere

    ------------------------------
    ahad
    ------------------------------



  • 2.  RE: Custom Use cases

    Posted Thu January 23, 2025 04:37 PM

    I agree.  This is a common thing in Splunk and seems like it should be encouraged for QRadar, as well



    ------------------------------
    Christopher Williams
    ------------------------------



  • 3.  RE: Custom Use cases

    Posted Sat March 08, 2025 02:33 PM

    Hi,

    As said by Cristopher it should be delivered by community people. What i found that Splunkers are more active than QRadar people.

    However, now you can convert any Sigma/Yara rule to QRadar rule, i hope you find some useful Sigma usecase. There is an app to do this "YARA and Sigma Manager" something, try it out.



    ------------------------------
    Abdul Quadeer
    ------------------------------



  • 4.  RE: Custom Use cases

    Posted Tue March 11, 2025 02:34 AM

    Hey Abdul, 

    Correct you can utilise the Yara and Sigma Rule Manager App to try out new use cases and create detection rules. It has an example embedded in the app itself so you can install and get started right away. We can think along the lines of sharing github repositories from community over at the app if we get good responses so please do keep the engagement going strong! Thanks.



    ------------------------------
    Shivam Sharma
    Product Manager
    IBM
    ------------------------------