QRadar Sections 1 - 8

QRadar Sections 1 - 8 What does the Event Collector do? - Receives Log Source events and normalizes them to QRadar events. What are QRadar events stored as? - Arial data structure What are all events processed by? - Custom Rule Engine (CRE) What are the three admin tabs? - System Configuration, Data Sources, and Remote Networks and Services Configuration What does a Soft Clean do? - Marks all open offenses as inactive What does a Hard Clean do? - Purges all current and historical SIM data. What is the Host Context? - Monitors all QRadar SIEM compenents to ensure that each component is operating as expected. What is the Accumulator? - Analyzes flows, events, and reports, writing database data and alerting a DSM. When does the daemon send an email about storage concerns? - 75% If the shutdown threshold is exceeded, partition capacity must fall below the recovery threshold of _ before it can be restarted? - 90% What are the disk usage sentinel settings? - Warning Threshold, Recovery Threshold 90%, Shutdown Threshold 95%, and Inspection Interval 1 min. What are the SAR Sentinal Settings? - Inspection interval (5 mins), Alert interval (120s), and Time Resolution (60) What does the SAR Sentinel do? - Supports system level monitoring for CPU, Disk, Interrupt, Load, Memory, and Network What are the Log Manager Settings? - Inspection Interval (1 min), Monitor Syslog File Name (), and Alert Size (1000) How to enable encryption between two managed hosts? - Both must be running QRadar SIEM 5.1 or later The contents of data in the application layer network defined by the OSI model is? - Payload Which OSI layers are network specific? - 1-3 Physical, Data Link, Network Which OSI layers are network-independent? - 4-7 Transport, Session, Presentation, Application What is the default for Maximum Data Capture/Packet? - 246 bytes What is the default for Maximum Content Capture? - 64 bytes When are DSM and Protocol updates released? - Every Monday If the QRadar console can't access the internet how do you get updates? - Manually or via a QRadar SIEM update server. How many days do you have to re-allocate a license? - 14 days If a single log source upgrade is purchased what are new license keys required for? - All log sources (sensor devices) Do flow collector appliances require license keys? - No If a customer owns one Flowprocesser at 100,000 flows and 2 at 200,000 flows what is the total console license? - 500,000 flows What is the Events Per Second (EPS) rating on the console? - 1000 EPS (this is for QRadar events because all other event processes are offloaded to the dedicated Event Processors) What are the three categories of licenses? - Appliance, Software, and Capacity A license with a License Appliance Type of Any Appliance Type can be allocated to? - Any host. How do you upload a license? - Upload license button. What do you need to do after uploading a license? - Allocate System to License When does the license grace period begin? - When the license is uploaded. Is an unallocated license considered allocated or unallocated? - Both. Where can you export a license key? - System and License Management Actions Export Licenses What much each user have? - A role and security profile. The two default roles are? - Admin and all