Data accumulation

Data accumulation is one of the important concepts to understand. Many of the applications, such as dashboards and reports, work on data accumulation. So, what is data accumulation in QRadar?

In Chapter 1, we spoke about the hostcontext service and we saw that there are multiple subservices of hostcontext. One of them is the accumulator service. If configured, the accumulator service is responsible for keeping a separate copy of the data. The data from the Ariel database is not removed or edited in any way. It is just that a separate copy of the small set of data from the Ariel database is maintained. This separate copy of data is called Global View (GV) in QRadar.

For example, we have configured to accumulate Cisco firewall logs where the event name is Connection Denied. The accumulator service will pick up all the events named Connection Denied and store them in a GV. GVs are storage compartments where specific events can be saved or duplicated for easier...