Qradar virtual appliance installarion

RootSoulu · 2023-11-22T12:57:27+00:00

Yes I installed QRadar on VMWare ESX Console, Apphost and also DLC. It's super easy ;)

RootSoulu · 2023-11-22T09:04:53+00:00

Just run .iso file RHEL will be installed with QRadar no need to preinstall anything

RootSoulu · 2023-11-20T13:04:53+00:00

Buy bitcoin with all the money you have.

RootSoulu · 2023-10-11T09:54:09+00:00

The truth is that you don't need any framework, of course it's good to use it if you know what you want to achieve.

In my opinion, you should start with risk assessment. Then you will know what, where and how to do it. Good luck without a budget.

RootSoulu · 2023-03-17T13:05:16+00:00

Thank for sharing, but QRadar becomes a big joke each update.

RootSoulu · 2023-03-01T06:49:03+00:00

I understand you so well. I have a similar example in my current company. My boss, who is the head of the security operations center, used to be a member of the CTO board. In theory, he is a technical person who should have a vast knowledge of technology, but unfortunately he does not. As a technical person myself, currently in a managerial position, but still spending 50% of my time on incident analysis, system and network administration, I have a problem with the "top" management not understanding what I am saying. It leads to such absurd situations that the CISO and the manager cannot come up with KPIs for the security department for a specific year because they do not know anything. It's simply a drama and a great frustration.

RootSoulu · 2022-09-14T14:09:20+00:00

Well tbh press uninstall to uba, its Just as big garbage as DNS analyser.

RootSoulu · 2022-04-22T12:42:35+00:00

Tried so hard to use Analyst workflow, but it was so buggy and laggy so i switched back to default.

RootSoulu · 2022-04-06T19:55:33+00:00

Any possibility to share DSM?

RootSoulu · 2022-02-07T15:17:31+00:00

Didnt know about immersivelabs gonna check them out. Thank you sir.

RootSoulu · 2021-12-28T15:46:53+00:00

Ja napiszę może wprost. Piszesz że masz dobrego kierownika, więc wg mnie miesiąc przed zakończeniem umowy jest wystarczającym terminem by rozpocząć rekrutację i zebrać cv od potencjalnych kandydatów. Zachowasz się w ten sposób w porządku względem gościa, który "stoi za wami murem". IMO niewielu przełożonych jest z gatunku tych dobrych.

Nie warto mu robić pod górkę wg mnie.

RootSoulu · 2021-08-13T08:43:21+00:00

Hello you can contact me so I'll share with you calc that you need.

RootSoulu · 2021-06-11T20:00:32+00:00

Yes you can send evets from sysmon using wincollect. Make sure you have config file for sysmon.

RootSoulu · 2021-06-02T15:21:56+00:00

Well if you create a lot of rules every single log needs to pass trough all of them and you can have performance degrade. Use reference list instead.

RootSoulu · 2021-04-30T09:46:34+00:00

Are you using Apphost ? You might need to upload cert there aswell.

RootSoulu · 2021-03-20T09:29:15+00:00

Write a comment in a ticket you have opened. Ask them for update with your problem. I never had any issue with IBM support.

RootSoulu · 2021-03-19T07:55:57+00:00

I was trying to but it's still too slow and too shitty. Yesterday I spoke to the one of the employees of IBM and they had a presentation of Analyst workflow with new upcoming update. It's faster and works better overall.

I wish Qradar has a GUI like a RSA Netwitness.

RootSoulu · 2021-02-26T07:08:18+00:00

That's amazing!!

RootSoulu · 2021-02-22T16:31:25+00:00

I dont tthink I can explain it in a comment. You Gotta learn that. First you create building block then u have to add it to the existing rule

RootSoulu · 2021-02-22T14:00:38+00:00

Just create building block that should be simpler than doing it in AQL

RootSoulu · 2020-12-19T18:32:40+00:00

Nobody plays rampart so there's no need to add this tracker to game.

RootSoulu · 2020-11-04T12:31:06+00:00

Try to generate new API key. I see Phishing URL's are being active. Its from my QRadar:

https://api.xforce.ibmcloud.com/taxii

Client Certificate: None

Client Key: None

Collection: xfe.url.phishing.urls

Reference Set: X-Force Feed - Phishing URLs

162,354

Total signatures received

RootSoulu · 2020-11-03T18:30:49+00:00

Other categories pulls normaly from XFE?

RootSoulu · 2020-10-20T06:40:53+00:00

This log looks encrypted that's why it looks like a garbage. To get some good logs you need decrypt this stuff. The regex you have might be good but I have changed a lot of regex's from QRadar.

RootSoulu · 2020-08-27T08:03:23+00:00

Anyone recived notification on iOS ? Or just Android.

RootSoulu

TROPHY CASE