IBM Security QRadar

 View Only

Want to check the health and performance of your QRadar Deployments?

By Sophia Sampath posted Thu June 13, 2019 09:40 PM

  

The QRadar Deployment Intelligence (QDI) App, available on the IBM Security App Exchange, is an application to visualize, monitor and investigate the health and performance of your QRadar deployments all in one single view.

I’m going to outline a couple of the major components that this app offers to help you better understand the health of your QRadar deployment.

 

Deployment Overview

The deployment overview gives an aggregated view of the hosts of your QRadar deployments. With that said, when you collapse the Deployment Overview screen you will see other collapsible headers which denotes every single host in a deployment.



In the Deployment Overview, you will see several dashboard widgets for graphing various metrics:

 Deployment Health heat map

 

 Notification Mapping

 

Status Feed

 

Component Status/Process Outage


Search/API Activity

 

 Expensive Security Data Artifacts [Rules, Offenses, Log Sources, Custom Event Properties]


Host Level View

The Host level view provides metrics associated to a particular QRadar Host.


Status Uptime

 

Host Information

Host level Advanced view

This Host level Advanced view let’s you view metrics for a particular host. Once you’ve selected the component you want to view, it will start populating metrics for that particular host.

 

 

Advanced Health Querying

This lets you query health metrics of historical data. 

 

Configure Graphs

 

The QDI App offers the ability to configure the predefined graphs. All the line charts in the QDI App is shows 300 data points per line by default and increasing the data points offers better resolution. However, it will consume more memory in your processor and can possibly make the app slower.

 

Additionally, you can configure the time window in which you want to query the metrics of your deployment.

 

 

Reporting

 

This app generates reports of your defined QRadar metrics nightly for reporting purposes, such as the deployment health, the system health metric summary, top log sources and so on.

  

 

Next steps

If you’re interested in learning more about the health and performance of your QRadar Deployments and are keen on looking into the analysis of the result of your deployments and much more, I’d definitely recommend installing the QRadar Deployment Intelligence App.  

0 comments
35 views

Permalink