QRadar search tuning

Earlier, we looked at the different types of searches. QRadar searches are one of the most computationally expensive functions. If done right by following a few rules, the searches will work smoothly and efficiently. Otherwise, you will end up with performance issues on various fronts. All the searches are initiated from the QRadar Console and hence, if searches are done wrong, it might affect the other functionalities or services on the Console.

Here are a few rules when it comes to QRadar searches. Let’s dive in!

Indexing and index management

An index is metadata that is generated for the data in the Ariel database. This index data can be generated as soon as the events or flows are ingested in QRadar, or the index can also be generated before running searches (i.e., post-data ingestion). Indexing is used to make the QRadar searches fast and efficient.

Indexing is enabled on the property of the events/flows. For example, source IP would be...