IBM QRadar

Introducing QRadar Network Insights - 40gbps Napatech Stacking

What’s new:

• You can stack the new QRadar Network Insights 1940 appliances (appliance type 6600) to scale performance by balancing the network packet data load across multiple appliances
• Stacked appliances can help you handle higher data volumes and improve flow throughput performance at the highest inspection levels
• In a stacked configuration, the QRadar Network Insights 1940 appliances provide one port for incoming traffic and one port for outgoing traffic
• Note: Stacks of different appliance types are not supported. i.e., 1920s cannot be stacked with 1940s

QRadar Network Insights Enhancements

• Content flows are more easily identified

  • All Content Flows will now consistently appear in the same direction orientation as their Data Flow counterpart

    QRadar 7.4.2 makes it easier to identify content flows that are received from QRadar Network Insights:

    • In the Flow Information window, the Flow Type field shows Standard Flow (Content Flow).
    • On the Network Activity tab, the tooltip for the Flow Type icon shows Standard Flow (Content Flow).
• New TCP Flow Direction algorithms

  • New flow direction algorithms that can be observed from QNI, including:

    • QNI TCP Handshake Observed (unaltered)
    • QNI TCP Handshake Observed (reversed)

• Easily determine the direction of content flow
  • The direction of the content flow is indicated by one of the following annotations:
    • Unknown (0)
    • Default Direction (1)
    • Source to Destination (2)
    • Destination to Source (3)

• More descriptive entity alerts

  • The entity alert includes more information about the type of suspicious content that was found so that you can triage each type of entity alert separately.
    The following entity alerts are new in QRadar Network Insights 7.4.2:

    • entity alert - IP address
    • entity alert - MAC address
    • entity alert - Phone number
    • entity alert - Credit Card Number
    • entity alert - Email Address
    • entity alert - Social Security Number
    • entity alert - UK NINO
    • entity alert - UK postal code
    • entity alert - Zip Code

QRadar Flow Enhancements

What’s New:

• Accumulated byte and packet counters
  • Easily see the total number of bytes and packets that accumulated over the duration of the flow session. The byte and packet counters for each 1-minute interval that the flow is observed are also preserved.

  • You can view the accumulated counters by including the following fields in your search results. Accumulated source bytes

    • Accumulated source packets
    • Accumulated destination bytes
    • Accumulated destination packets
  • Benefits:

    • You can view the accumulated counters by including the following fields in your search results. 

      • Accumulated destination bytes
      • Accumulated destination packets
      • Accumulated source packets
      • Accumulated source bytes

• New “Common Destination Port” flow direction algorithms
  • Introducing two new common destination port algorithms for use when the flow matches the criteria, but the flow direction is unchanged:
    • Single common destination port (unaltered) (5)
    • Both common destination ports, RFC 1700 preferred (unaltered) (6)
  • Benefits:

    • Now, the only flows that show the Arrival time annotation in the Flow Direction Algorithm field are the flows that do not match the criteria for any other flow direction algorithm.

• MAC address support
  • You can now receive MAC address information from IPFIX and NetFlow V9 exporters
  •  Benefits:

    • The following MAC address fields are supported in QRadar 7.4.2:

      • sourceMacAddress (IANA Element ID 56)
      • postDestinationMacAddress (IANA Element ID 57)
      • destinationMacAddress (IANA Element ID 80)
      • postSourceMacAddress (IANA Element ID 81)