IBM Security QRadar

 View Only
  • 1.  how works indexes in Qradar ?

    Posted Wed July 10, 2019 09:05 AM
    Hi,
    someone can explain me how works the indexes / super indexes in qradar plz? i didn't found any deep informations on this subject :(

    Thanks !


  • 2.  RE: how works indexes in Qradar ?

    Posted Thu July 11, 2019 11:06 PM
    Edited by Anthony Gayadeen Thu July 11, 2019 11:18 PM
    Hi,
    from a user perspective, the only thing you need to know is which field is indexed for your searches and rules to run efficiently.

    Here's a page that explains this matter:
    https://www-01.ibm.com/support/docview.wss?uid=swg21689802

    SuperIndex refers to the Ariel database, but you don't really need to worry about this unless your the system admin and you're having disk space issues.

    ------------------------------
    Anthony Gayadeen, Videotron Ltd
    Montreal QC
    ------------------------------


  • 3.  RE: how works indexes in Qradar ?

    Posted Fri July 12, 2019 03:31 AM
    hi Anthony ,

    thx for your answer!
    but in my case i want information about index and SuperIndex if available ;)

    ------------------------------
    Pipotron 2.0
    ------------------------------



  • 4.  RE: how works indexes in Qradar ?

    Posted Fri July 12, 2019 02:13 PM
    Hi,

    so you're looking for more info on the Ariel database. IBM doesn't provide any documentation for their database structure. I'm assuming that you want more info to be able to do stuff with it ;) I'm not even sure that IBM permits playing with their database directly. My guess is that you'll lose support for your system if you start querying directly in that base with you're own tools. You can check out the AQL document, but it doesn't explain what you're looking for.
    https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/b_qradar_aql.pdf

    I guess you'll have to explore on your own or open a ticket with support. Good luck!
    Regads,

    ------------------------------
    Anthony Gayadeen, Videotron Ltd
    Montreal QC
    ------------------------------



  • 5.  RE: how works indexes in Qradar ?

    Posted Mon July 15, 2019 03:44 AM
    Hi,

    yep it will be complicate to get informations :p
    thank you anyway

    ------------------------------
    Pipotron 2.0
    ------------------------------