Hi EveryoneI'm very pleased to announce that we have just released the upgraded IBM QRadar Reference Data Management application to the IBM Security App Exchange. If you are using QRadar this application is an essential tool for your day to day business. You can download it from here.
Are you dealing with Whitelists and Blacklists?
Are you pulling Threat Intelligence IOC’s into QRadar?
Are you searching or correlating flat lists of IOC’s in your rules and searches?
Or maybe you require a table or map of data in QRadar. Examples here might be importing CMDB data into QRadar for data enrichment with AQL properties or needing to edit or interact with the reference tables & maps of data that come OOTB with the UBA application (User Behaviour Analytics).
Just some of the possible use cases in QRadar for reference data. Lets take a quick look at the Reference Data application and some of the key features to enable these use cases.
Easily search, add, edit or create a reference set for QRadar. From there add IOC's (indicators of compromise), delete IOC's, bulk upload or import and export csv lists from QRadar.
What I really like from here, this application will simply list out the dependancies of this reference data. So you easily know how the changes you make will impact your rules and searches.
Not only will this application help you interact with reference sets, but all other reference data is covered off, Tables, Maps and Map of Maps. Previously only viewable via the interactive API's in QRadar now we have a simple interface to allow you search, create, edit or delete these and update data inside this reference data.
This application is very easy to use and an essential tool for working in QRadar. Download it today and start getting the most out of reference data for QRadar.