E-Learning: QRadar EDR: Administering Your Environment - SPVC (BQ520XG)

When deploying IBM Security® QRadar® EDR into production, you must configure important details, such as notifications, alerts, and policies. After QRadar EDR is deployed successfully, you must set up your users, groups, and clients, configure your Hive-Cloud score, and define how to handle downloaded and quarantined files from endpoints. Another important maintenance task revolves around monitoring audit logs.

This course applies to version 3.12 of the on-premises QRadar EDR offering as well as the January 2024 SaaS-based offering.

Audience

• Security Operations Center (SOC) Administrator
• SOC Analyst
• Security Analyst
• Incident Responder
• Managed Service Security Provider (MSSP)

• Configuring notifications and Simple Mail Transfer Protocol (SMTP)
• Setting up forwarding alerts
• Defining policies
• Handling downloaded and quarantined files from your endpoints
• Setting up users, groups, and clients
• Configuring Hive-Cloud Score
• Creating applications
• Monitoring audit logs

1. Configuring tools
2. Managing the environment
3. Reviewing downloads and audit logs
4. Detections Strategies (DeStras) lab
5. Agent installation lab