Folks,
Check out this
great video from Jose on how to use QRadar Deployment Intelligence to investigate search performance. In any QRadar system of a decent size and use I'm sure users will always have queries about searches now and then and why they are taking as long as they do. Being able to quickly diagnose and explain searches issues is really critical.
To help with this process, and of course remediation (e.g. user training, adding data nodes, adding indexes, applying resource restrictions etc.) QRadar logs a lot of information about every search performed on the platform by users and by apps!
QDI then takes this information and turns it in something that's very useful to understand who are the top searchers on the platform, and allows you to drill into each user and understand the important 'features' of each and everyone of their searches..
Definitely worth checking it out — and leave any questions or comments you have below.
#QRadar