QRadar Use Case Manager app
While working with QRadar, you might have noticed the enormity of data and the number of rules that a QRadar administrator must work with. The sheer number of rules that come out of the box with the system, and the rules added when new apps and extensions are installed, can be overwhelming. On top of that, some organizations need customized alerts for which custom rules must be created. Managing these rules is a challenge. As we learned in earlier chapters, enabling all the rules is counterproductive and will adversely affect QRadar performance. So how do you manage QRadar rules? The QRadar Use Case Manager app is designed to manage QRadar rules and optimize them. We will look at both these functionalities.
Before we discuss this app in detail, let us understand what the MITRE ATT&CK framework is and how it is used by the QRadar Use Case Manager app.
MITRE ATT&CK is a framework designed for security analysts, threat hunters, red/blue teams...
