IBM QRadar

Please let us now following for Qradar & QNI all appliances 

1) Based on below details, the qradar appliance is pre harden & got certified right ?

https://www.ibm.com/support/pages/qradar-hardening-qradar-appliances

Under no circumstances should you harden your system using unsupported methods or make hardening changes without talking to IBM Security Services. Hardening changes can violate your support contract and might cause product issues or significantly impact your ability to receive support.

For more information about security certifications, see QRadar US federal certifications.

2) Based on below link, we notice that below appliances not possible to use STIG & STIG is not supported in QRadar high-availability (HA) deployments, If so IBM appliance are harden with security requirements & got certified ?

https://www.ibm.com/docs/en/qsip/7.4?topic=guide-stig-qradar-installations

but they are not currently supported:

• IBM QRadar Network Insights,IBM QRadar Incident Forensics, IBM QRadar Network Packet Capture, Data Nodes, App Nodes etc

3) How to show customer the devices are pre harden or show the harden settings

4) Based on IBM Certified list, Please refer the screenshot, on NIST List we never find any qradar version & similarly for STIG, Then how to prove customer the qradar are certificated without proper artifacts, for example it shows other IBM software or appliance list on NIST Portal like DB2, MQ appliance, Websphere etc.

5) Similarly when we reverify NIST or CIS Linux Hardening Checklist with Qradar appliances either mostly not applicable or not harden.

------------------------------
Sunil I B
------------------------------

Please let us now following for Qradar & QNI all appliances 

1) Based on below details, the qradar appliance is pre harden & got certified right ?

https://www.ibm.com/support/pages/qradar-hardening-qradar-appliances

Under no circumstances should you harden your system using unsupported methods or make hardening changes without talking to IBM Security Services. Hardening changes can violate your support contract and might cause product issues or significantly impact your ability to receive support.

For more information about security certifications, see QRadar US federal certifications.

2) Based on below link, we notice that below appliances not possible to use STIG & STIG is not supported in QRadar high-availability (HA) deployments, If so IBM appliance are harden with security requirements & got certified ?

https://www.ibm.com/docs/en/qsip/7.4?topic=guide-stig-qradar-installations

but they are not currently supported:

• IBM QRadar Network Insights,IBM QRadar Incident Forensics, IBM QRadar Network Packet Capture, Data Nodes, App Nodes etc

3) How to show customer the devices are pre harden or show the harden settings

4) Based on IBM Certified list, Please refer the screenshot, on NIST List we never find any qradar version & similarly for STIG, Then how to prove customer the qradar are certificated without proper artifacts, for example it shows other IBM software or appliance list on NIST Portal like DB2, MQ appliance, Websphere etc.

5) Similarly when we reverify NIST or CIS Linux Hardening Checklist with Qradar appliances either mostly not applicable or not harden.

------------------------------
Sunil I B
------------------------------