IBM Security QRadar SOAR

 View Only

How to improve SOAR performance?

  • 1.  How to improve SOAR performance?

    Posted Tue November 09, 2021 07:02 AM
    Hi
     
    I've noticed that most SOAR REST API calls take about 1-2 seconds to complete (e.g. incident creation)
     
    Also, I've noticed that scripts complete pretty fast (millis) but REST calls (using fn_functions) takes about 1-2 seconds.
     
    And if I trigger workflows from incident creations, I can't get much parallelism from it. It sounds like SOAR executes the workflows in a sequence, sometimes.
     
    Is there any fine tuning I can try in order to improve these numbers, or to make SOAR run these workflows faster? 
     
    I've tried increasing the Java heap in the services scripts, some postgresql settings, and nothing seems to make much difference.
     
    I am using a 32 GB RAM machine with 8 CPUs (virtual)
     
    TIA
    Leonardo Kenji Shikida
    Security Delivery Specialist
     
    Phone: 55 31 99994 0875