Security / Technical Security

IBM QRadar SIEM Foundations (BQ105G)

Authorized IBM training (BQ105G) — a three-day entry-level QRadar SIEM course: architecture and data flow, log sources, network flows and QRadar Network Insights, the Custom Rule Engine, working with offenses, searching with AQL, reporting and the admin console.

QRadar without foundations is a console nobody can read

QRadar SIEM shortens the gap between suspicious activity and its detection — but only when the team understands where the data in the console comes from and why a particular event turned into an offense. Without that, the platform is a board full of numbers nobody can defend in front of an auditor.

This is the authorized IBM course BQ105G, delivered by EITT as an authorized reseller of IBM training in Poland. Three days lead from architecture and data sources, through rules and assets, to working with offenses, searching with AQL and reporting.

Who is this training for?

For people starting with QRadar SIEM, or taking the platform over from someone else. Especially when:

You are joining a SOC and will handle offenses without knowing where they come from
You are responsible for security monitoring and need an ordered foundation instead of knowledge pieced together from documentation fragments
You design the event monitoring layer and want to understand what QRadar can collect — and what it cannot
You are expected to report on security to management or to an auditor

Three days: from architecture to report

Day 1 — where the data comes from. QRadar architecture, the data flow from collector to console, the user interface and defining log sources. After this day you know exactly what you are looking at, and why.

Day 2 — how data becomes a detection. Network flows and QRadar Network Insights, the Custom Rule Engine, Use Case Manager, assets and platform extensions. This is the day an event becomes an offense.

Day 3 — what to do with a detection. Working with offenses in the UI and in the Analyst Workflow app, searching with AQL, reporting and Pulse Dashboards, plus an overview of administrative tasks.

Lab exercises run through all three days on an IBM QRadar SIEM 7.5 environment.

Benefits

Describe how QRadar collects the data used to detect suspicious activity
Describe the QRadar architecture and the data flow between its components
Navigate the QRadar user interface, its tabs and dashboards
Define log sources and collection protocols, and interpret event details
Explain how QRadar collects and analyses network flow information
Describe how the Custom Rule Engine works and how offenses are created
Use the Use Case Manager app to review use case coverage
Discover assets and manage asset information
Recognise QRadar apps, content extensions and the role of the App Framework
Analyse offenses in the QRadar UI and in the Analyst Workflow app
Search, filter and group security data
Analyse security data to reconstruct the course of an incident
Use AQL for advanced queries over events and flows
Create custom reports in QRadar
Explain aggregated data management and build reporting on Pulse Dashboards
Recognise QRadar administrative tasks and where they live in the admin console

Who is this training for?

Security analysts starting to work with QRadar SIEM

Security technical architects designing the event monitoring layer

Offense managers responsible for handling and prioritising offenses

Network administrators cooperating with the SOC team

System administrators working with QRadar SIEM

Prerequisites

IT infrastructure
IT security basics
Linux
Microsoft Windows
TCP/IP networks
Syslog — log files and events

Training program

IBM QRadar 7.5 fundamentals — why SIEM, and how QRadar collects data on suspicious activity
QRadar architecture — components, data flow from collector to console, deployment models
QRadar UI overview — tabs, navigation, dashboards, view permissions
Log sources — defining a log source, collection protocols, event details and normalisation
Lab exercises: architecture, UI overview, defining a log source

QRadar flows and QRadar Network Insights — how QRadar collects and analyses network traffic information
Custom Rule Engine (CRE) — building and testing rules, offense creation
QRadar Use Case Manager app — reviewing use case coverage and rule status
Assets — discovery, profiling and asset information management
QRadar extensions — apps, content extensions and the App Framework
Lab exercises: flows and QRadar Network Insights, CRE, Use Case Manager, assets, App Framework

Working with offenses — analysis in the QRadar UI and in the Analyst Workflow app
Searching, filtering and grouping security data
AQL — Ariel Query Language for advanced queries
Reporting and dashboards — custom reports, aggregated data management, Pulse Dashboards
QRadar admin console — an overview of administrative tasks
Lab exercises: working with offenses, search and AQL, reporting and dashboards, administrative tasks
Lab environment: IBM QRadar SIEM 7.5

Delivery Methods

Online

Convenience of participating from anywhere
Interactive live sessions with trainer
Materials available for 30 days
No travel costs

On-site

Direct contact with trainer and group
Intensive hands-on workshops
Networking with other participants
Full focus on learning

Training Topics

Your Learning Path

IBM QRadar SIEM Foundations (BQ105G)Current training

IBM Security QRadar SIEM Advanced Topics.IBM QRadar SIEM Advanced Topics — advanced level

Frequently asked questions

Is this an authorized IBM training?

Yes — this is the official IBM QRadar SIEM Foundations course (BQ105G), delivered by EITT as an authorized reseller of IBM training. The programme follows the IBM standard.

Do I need prior QRadar experience?

No — this is the entry-level QRadar SIEM course and it does not require any earlier course from this family. We do assume familiarity with IT infrastructure, IT security basics, Linux and Windows, TCP/IP networks, and log files and events.

What is the format and duration of this training?

The training lasts 3 days and is available in online and on-site format. Sessions run from 9:00 AM to 4:00 PM. Every day combines lecture with lab exercises on an IBM QRadar SIEM 7.5 environment.

What comes after this training?

The natural next step is the authorized IBM QRadar SIEM Advanced Topics course — custom log sources, reference data, custom rules, tuning, IBM X-Force Threat Intelligence, user behaviour analytics and IBM SOAR integration.