QRadar Incident Forensics (QRIF)
The QRadar Incident Forensics processor is added to the QRadar Console like any other managed host. Packet capture appliances are attached to the QRIF processor. This helps the processor import the required packet capture information from packet capture (PCAP) appliances.
Usually, when we are investigating an offense, we would like to see what happened, which in essence is incident forensics. For example, an offense is triggered for an employee called Bob. If we right-click on Bob and click on Forensic recovery, the QRIF processor will collect all information related to Bob, such as the emails that Bob sent, his downloads, chat sessions, browser history, and so on.
The QRIF processor queries the data based on the filter from the PCAP appliances and recreates the traffic as it is. So, the email attachments that Bob sent are also reconstructed.
Figure 2.7 – Deployment with QRIF and PCAP
A QRadar deployment can...
