Overview

When deploying IBM Security® QRadar® EDR into production, you must configure important details, such as notifications, alerts, and policies. After QRadar EDR is deployed successfully, you must set up your users, groups, and clients, configure your Hive-Cloud score, and define how to handle downloaded and quarantined files from endpoints. Another important maintenance task revolves around monitoring audit logs. 

This course applies to version 3.12 of the on-premises QRadar EDR offering as well as the January 2024 SaaS-based offering.

Audience

Security Operations Center (SOC) Administrator

SOC Analyst

Security Analyst

Incident Responder

Managed Service Security Provider (MSSP)

Prerequisites

Objective

• Configuring notifications and Simple Mail Transfer Protocol (SMTP)
• Setting up forwarding alerts
• Defining policies
• Handling downloaded and quarantined files from your endpoints
• Setting up users, groups, and clients
• Configuring Hive-Cloud Score
• Creating applications
• Monitoring audit logs

Course Outline

1. Configuring tools
2. Managing the environment
3. Reviewing downloads and audit logs
4. Detections Strategies (DeStras) lab
5. Agent installation lab