Summary
In this chapter, we have discussed the crux of QRadar management, which is running searches and maintaining QRadar in such a way that the searches are efficient. We have also discussed various ways in which we can tune the searches. The majority of the issues faced by customers are linked to searches. If you went through this chapter thoroughly, you should now understand the fundamentals of searches, such as the services involved, filters used, indexing, and so on. This should immensely help SOC admins to design searches and SOC analysts to run them.
The concept of SIEM revolves around gathering relevant security information, analyzing the data, and generating alerts for the SOC team. The security alerts in QRadar are called offenses because the alerts are generated when the rules laid down by the QRadar admin are offended. We will discuss the various aspects of rules and offenses in the next chapter.
