Hello everyone,
I would like to ask for recommendations/best practices regarding overlapping internal networks in QRadar.
Ι have aν environment where the same internal subnet is used in different remote sites/networks. For example, the subnet 192.168.10.0/24 exists in more than one location (one of them is a Guest network).
The issue is that QRadar detects the subnet as duplicate in the Network Hierarchy, so we cannot create separate entries for each network/site.
Has anyone handled a similar scenario in QRadar?
Any recommendations or design approaches would be greatly appreciated.
Thanks for your time.