General Research

Foundations of Splunk SIEM PlatformSplunk is a software platform designed for searching, monitoring, and analyzing machine data generated from various sources such as applications, servers, and network devices. It provides real-time visibility into your entire...

Sending Windows Logs to QradarWindows logs give QRadar important information about user activity and system events on Windows-based devices. These logs cover a range of event categories and are usually obtained by Windows Event Forwarding (WEF) or the QRadar Windows...

Understanding Qradar RulesQradar Rules are predefined or custom-defined conditions that trigger alerts or notifications when specific events occur within the monitored environment. These rules help identify security threats, compliance violations, and operational...

Creating Qradar Custom RulesQradar Rules are predefined or custom-defined conditions that trigger alerts or notifications when specific events occur within the monitored environment. These rules help identify security threats, compliance violations, and operational...

In IBM QRadar, Event Properties are crucial elements used to define and analyze security events. Each event in QRadar contains a set of properties that helps you understand the context of the event, categorize it, and identify potential security issuesEvents are...

Foundation of Cyber Kill ChainThe Cyber Kill Chain is a security model originally developed by Lockheed Martin to describe the stages of a cyberattack. It's widely used to help organizations understand, detect, and mitigate attacks.The Cyber Kill Chain Framework is an...