Easily adjust the number of MAC addresses that are allowed for a single asset!For users that log in from multiple wireless access points, or multiple users that log in remotely through a VPN, you can set the number of MAC addresses that are allowed for the asset in the same way that you can for IP addresses
Generating regex for parsing event properties
Note: The regex generator works best for fields in well-structured event payloads. If your payload consists of complex data from natural language or unstructured events, the regex generator might not be able to parse it and does not return a result
All Content Flows will now consistently appear in the same direction orientation as their Data Flow counterpart
New flow direction algorithms that can be observed from QNI, including:
The entity alert includes more information about the type of suspicious content that was found so that you can triage each type of entity alert separately.The following entity alerts are new in QRadar Network Insights 7.4.2:
You can view the accumulated counters by including the following fields in your search results. Accumulated source bytes
You can view the accumulated counters by including the following fields in your search results.
Now, the only flows that show the Arrival time annotation in the Flow Direction Algorithm field are the flows that do not match the criteria for any other flow direction algorithm.
The following MAC address fields are supported in QRadar 7.4.2:
Thanks, @Sophia Sampath, for this Informational Post. The MAC Address is a very important Update that benefits SOC Analysts in Triaging and reducing FPs quite a lot.