QLEAN for QRadar Tuning & Health Check

QLEAN for IBM® Security QRadar® SIEM

The most advanced QRadar health check and LEAN SOC automation solution to proactively improve SIEM performance and maintenance.

Analyze with health check report

QLEAN users get access to a comprehensive health check report that includes 37 performance and behavioral metrics. The Report offers an extended description of identified problems, hence helps security administrators to choose possible actions to recover the system’s operability.

Each report generated by QLEAN contains a detailed analysis with the following performance indicators:

• Console summary of the system’s state (the number of active log sources and assets, storage and memory available, top 10 unique offenses).
• EPS and FPI statistics.
• Events and flows timelines.
• Disk, CPU and memory usage on managed hosts.
• Log sources statistics.
• Incoming log data quality.
• Correlation rules and reports performance and more.

Diagnose with health markers

The markers draw an accurate portrait of the system, stressing such important aspects as:

• Critical modification to log sources
• Presence of uncategorized or unknown events
• Mistakes in correlation rules
• Excessive time of correlation rule execution
• Slow response of correlation rules
• Detected auto-update errors

Faultless performance

QLEAN provides the system’s all-round profile by revealing pain spots that should be fine-tuned or reconfigured to ensure a higher level of protection:

• EPS and FPM Timelines reflect the amount of events and flows processed within the system over a certain period of time, thus alerting security specialists when the enabled licenses don’t match the real number of data coming to the system.
• Events and Rules reveal average and peak EPS per log types within a specified timeframe, as well as show how fast correlation rules are executed, their response time, the number of responses per correlation rule, etc. Therefore, security administrators can optimize badly configured or incorrect rules consuming too many resources.
• Offense Analysis helps to identify correlation rules generating the abnormal number of false-positives, thus requiring to be fine-tuned.
• Heavy Reports depict the reports that take the longest time to be generated, which points to the errors that are to be eliminated.

Homogeneous data

QLEAN helps to improve the quality of data collected from numerous log sources. This allows to minimize risks of missing important log data and overlooking critical security offenses due to log source misconfiguration. Via dedicated performance metrics, QLEAN for IBM QRadar SIEM informs security administrators about:

• Data generated by unknown/unsupported log sources.
• Misconfigured log sources that show inadequate coverage of security events.
• Maliciously misconfigured log sources.
• Disabled log sources that don’t generate any security events, and more.

Simplified maintenance

Advanced operational analytics of the tool enables CISOs to stick to a proactive information security strategy and eliminates the necessity to create custom scripts and additional reporting tools. This allows security specialists to enhance QRadar’s performance with less time, effort and budget required to maintain the platform.

The tool enables quick and timely improvements of the QRadar deployment by in-house security specialists, which allows companies to maintain excellent network protection.