Hi,

I am thinking to apply multi-tenancy on QRadar for differentiate a company's logs.

Is there a configuration of taking the back-ups of this log source/tenant/domain to the another folder rather than default back-up folder?

I am looking forward for your help and comments

------------------------------
Halil B.
------------------------------

In such cases I would advise to use separate event or combined event/flow processor instances per tenant. This way you could e.g. mount different network shares for each event processor to be used for their backup.

------------------------------
Dusan VIDOVIC
------------------------------

Hi @Halil BALIM,

While QRadar keeps data in separate directories as per https://www.ibm.com/support/pages/qradar-tenant-data-event-retention-or-flow-retention-faq ...

• Events: /store/ariel/events/records/aux/tenantID#/Year/Month/Day/Hour/Minute
• Flows: /store/ariel/flows/records/aux/tenandID#/Year/Month/Day/Hour/Minute

The data backup currently includes all tenants' data.​ I opened a request for enhancement (RFE) late 2018 to have one backup per tenant, but it was declined. The RFE was ID: 126298 - QRadar 7.3.1 Event & Flow data backup for multiple tenants.

IBM QRadar RFEs: https://www.ibm.com/support/pages/qradar-request-enhancements-rfe-and-how-use-them

------------------------------
Cheers,
Damian Zinni
------------------------------