- play_arrow QRadar Use Case Manager
- play_arrow What's New in QRadar Use Case Manager
- play_arrow Known Issues
- play_arrow Video Demonstrations
- play_arrow Supported Environments for QRadar Use Case Manager
- play_arrow Installation and Configuration Checklist
- Installation and Configuration Checklist
- Installing QRadar Use Case Manager
- Creating an Authorized Service Token
- Configuring the Use Case Explorer in QRadar Use Case Manager
- Assigning User Permissions for QRadar Use Case Manager
- Customizing User Preferences
- Predefined Report Content Templates
- Customizing Report Content Templates
- Custom Rule Attributes
- Creating Custom Rule Attributes
- Exporting and Importing Custom Rule Attributes
- Upgrading QRadar Use Case Manager
- Uninstalling QRadar Use Case Manager
- play_arrow MITRE ATT&CK Mapping and Visualization
- MITRE ATT&CK Mapping and Visualization
- Editing MITRE Mappings in a Rule or Building Block
- Editing MITRE Mappings in Multiple Rules or Building Blocks
- Sharing MITRE-mapping Files
- Visualizing MITRE Tactic and Technique Coverage in Your Environment
- Visualizing MITRE Coverage Summary and Trends
- Visualizing MITRE Tactics and Techniques that are Detected in a Specific Timeframe
- MITRE Heat Map Calculations
- play_arrow Investigating QRadar Rules and Building Blocks
- Investigating QRadar Rules and Building Blocks
- Filtering Rules and Building Blocks by their Properties
- Identifying Gaps in QRadar Rule Coverage from Content Extensions
- Investigating User Behavior Analytics Rules
- Duplicating Rules for Further Customization
- Exporting Rules
- Deleting Rules
- Rule Report Presentation
- Visualizing Rules and Building Blocks
- Visualizing Log Source Type Coverage per Rule
- play_arrow Accessing Report Data by using QRadar Use Case Manager APIs
QRadar Tuning
QRadar Use Case Manager provides several ways to tune your QRadar environment.
Tune Your QRadar Offenses by Analyzing Rules That Cause the Biggest Number Of Offenses
Tune most active rules
QRadar Use Case Manager can help you determine which rules generate the most offenses, and then guide you through the steps to tune them.
Tune based on the CRE event report
The Custom Rules Engine (CRE) event report shows which CRE events were generated most often. It also provides information about the rule activity. You can tune these rules or use the event information from the report to update your QRadar environment.
Tune Your QRadar Offenses by Going Through the Most Common Configuration Steps
Review network hierarchy
Network Hierarchy is used to define which IP addresses and subnet are part of your network. Defining your network hierarchy and keeping it up to date is an important step in helping prevent false offenses.
Review building blocks
Rules use information about your servers to determine whether to generate the rule responses. Review and update common rule building blocks to enable QRadar to discover and classify more servers on your network, and prevent false positives.
