- play_arrow What's New for JSA Users
- play_arrow Capabilities in your JSA product
- play_arrow Dashboard Management
- Dashboard Management
- Default Dashboards
- Custom Dashboards
- Creating a Custom Dashboard
- Using the Dashboard to Investigate Log or Network Activity
- Configuring Dashboard Chart Types
- Removing Dashboard Items
- Detaching a Dashboard Item
- Renaming a Dashboard
- Deleting a Dashboard
- Managing System Notifications
- Adding Search-based Dashboard Items to the Add Items List
- play_arrow QRadar Analyst Workflow
- play_arrow Offense Management
- play_arrow Log Activity Investigation
- play_arrow Network Activity Monitoring
- play_arrow Asset Management
- play_arrow Chart Management
- play_arrow Custom Event and Flow Properties
- play_arrow Rules
- play_arrow Historical Correlation
- play_arrow Juniper Networks X-Force Integration
- play_arrow Report Management
Finding IOCs Quickly with Lazy Search
Lazy search returns the first 1000 events that are related to the search criterion. For example, if you need to search for a particular MD5 as part of a malware outbreak investigation, you do not need to review every related event. Do a lazy search to quickly return a limited result set.
To take advantage of the lazy search, you must have the Admin security profile, or a non-administrator security profile that is configured in the following way:
Permission precedence set to No Restrictions.
Access to all networks and log sources.
Lazy search cannot be used by users with non-administrator security profiles on networks where domains are configured.
You use the JSAlazy search to search for an indicator of compromise (IOC), such as unusual outbound network traffic or anomalies in privileged user account activity.
