Summary
In this chapter, we dug deep into the fundamental aspects of QRadar, which are rules and offenses. We discussed different types of rules and how these rules can be designed to meet security requirements. We dealt with the minute details of optimizing rules with building blocks and using reference data.
After going through this chapter, you should be in a position to implement security use cases using QRadar rules and offenses. You will be able to use different types of rules, generate alerts in the form of offenses, and manage those offenses.
In the next chapter, we will discuss how internal threats can be mitigated using a QRadar app called User Behavior Analytics.
