QRadar 7.3.1, should you upgrade?

Posted on Updated on

The IBM QRadar 7.3.1 was released in the beginning of 2018. However, several companies still using past versions of the tool. One of the most asked question every time a new release is out is “Why should I upgrade?”. To answer this question, I compiled a list of interesting improvements in the past four major releases. This list was based on the official IBM release notes and several QRadar open mics.

 

QRadar 7.2.7

  • Indexing offence by any field, including custom fields
  • Customize columns on log activity tab, create custom layouts
  • See average EPS for each log source, on admin tab and reports
  • Support of if/then/else and case statements on AQL queries
  • Release of a software version of QRadar
  • All logs and flows are compressed when stored
  • Paging on searches (improving search performance)
  • Change network interface configuration through the web console (IP address, interfaces, bonding, etc)
  • Change firewall rules through the web console
  • New APIs for QVM and incident retrieval

 

QRadar 7.2.8

  • Resource restrictions for specific users (searches)
  • X-Force is already included in the QRadar subscription
  • Reference sets are now domain specific, each client has their own domain set
  • Data retention buckets now can be per tenant
  • Offence assignment is improved and offence screen support tenants
  • Web interface for DSM editor
  • AQL support nested queries
  • IBM Security Master Console now included with qradar. Provides a holistic view of the environment

 

QRadar 7.3.0

  • EPS/FPM is now a shared pool that can be distributed across devices
  • QRadar now runs on RedHat 7.3, which allows LVM for partition management. It also uses the SystemD for service management, meaning that you have to use “systemclt” to manage things in the system, like service start/stop
  • Activation keys are not necessary anymore. You select the type on a list
  • No more limit on log source numbers. The limit is by EPS
  • Tenant management is improved, the tenants can create their own reference sets and custom properties.
  • AQL now supports advanced statements, such as session queries, bitwise operators and functions.
  • Apps now can be outsourced to an external AppNode
  • New interfaces for remote networks and remote services
  • Java deployment editor doesn’t exist anymore, all device management happens through the admin interface

 

QRadar 7.3.1

  • New login screen, new logos and design.
  • New app called Pulse, very interesting dashboards, provide “SOC Views” and fancy graphs
  • Custom properties can now be based in AQL queries
  • Now it is possible to identify if QRadar inverted the flow in the network activity tab
  • Minor patch updates does not cause downtime anymore
  • Event collection now runs as a separated service, meaning you can restart just the event collection in a device
  • New left side menu, allows creating shortcuts and favourites
  • Browser-based notifications
  • New “QRadar Deployment Intelligence App” provides a lot of system health information
  • Possibility to enforce password policy
  • New “QRadar Assistant App” comes already with QRadar. It gives tips on how to use the tool, suggest apps, and provide a live feed of the IBM Security Support twitter.
  • Log source auto-detection can now be controlled, allowing only certain types of log sources to be auto-detected
  • Auto-discovery of event properties.
  • New offering of a Data Storage solution for QRadar, this allows to some of the logs to be collected only and not parsed by the pipeline (saving EPS). This can be interesting if one of the devices is on debug mode.
  • Support to JSON formats in log source extension parsing
  • AQL can now be targeted by event processor, improving search time
  • Geolocation is improved. Now you can manually enter the geolocation of IPs on the network hierarchy, so maps are correct.
  • New App Developer Center, so people can develop their own apps with the IBM SDK
  • Rules can now be triggered by distance on geolocation. “If a traffic comes from more than 100km from here”..
  • The vulnerability manager and risk manager are completely redesigned.
  • The incident forensics module supports packet capture and more advanced features

This entry was posted in Administration, Documentation, Installation, News, Sales and tagged , , .

Leave a comment