When an analyst right-clicks on the Source IP or Destination IP that is associated with an offense at the Offense Summary in QRadar, two of the top-level options are  DNS Lookup  and  WHOIS Lookup 1 .  These options provide additional information about the IP address, such as its domain name (DNS Lookup) and registration information (WHOIS Lookup) 1 .

Threshold rules in QRadar are designed to test events or flows for activities that are greater than or less than a specified range. These rules are particularly useful for detecting significant changes such as bandwidth usage variations, failed services, changes in the number of connected users, and large outbound data transfers. By setting acceptable limits within threshold rules, administrators can effectively monitor for and respond to abnormal activities within the network​​.

When deleting a generated content report in QRadar, all reports that were generated from the report template are deleted, but the report template itself is retained. This ensures that the structure for generating future reports remains intact, while only the instances of reports generated from that template are removed​​.

Pie Chart Logic:  Pie charts represent proportions of a whole.expand_more QRadar Pulse supports the following aggregations suitable for this:

Total (Sum):  Calculates the sum of a selected field ' s values, displaying each slice relative to the whole.

First:  Takes the first value encountered in a field, useful for categorical data to show initial distribution.

In IBM Security QRadar SIEM, generating a report using the QRadar Report Wizard requires a " Saved Search " and a " Layout. " A Saved Search is a predefined search criterion that users save in QRadar to reuse for various reporting or analysis purposes. It acts as the data source for the report, defining what data will be included. The Layout component refers to the structure and presentation of the report, including how the data from the Saved Search is organized and displayed. It encompasses the formatting, charts, tables, and other visual elements that make up the final report. Together, these components ensure that reports are not only informative but also well-organized and readable, catering to the specific informational needs and preferences of the users or stakeholders.

QRadar will mark an Event offense as dormant if no new events or flows occur within 30 minutes. However, if QRadar did not process any events within 4 hours, this also triggers the offense to become dormant. Once dormant, the offense remains in this state for 5 days unless new events or flows are added​​​​.

QRadar supports generating reports in various file formats, including PDF, HTML, XML, and XLS. These formats provide flexibility in how reports are viewed and shared, catering to different needs and preferences for report presentation and analysis​​.

Context Menu: Right-clicking on an IP address in the Offense Summary window offers quick investigation actions.

IP-Related Tools: WHOIS and DNS Lookups are essential tools for:

WHOIS:  Retrieving IP registration information (owner, contact details, etc.).  DNS:  Resolving domain names associated with the IP.