From the Admin tab, click Deploy Changes.Īfter the deploy changes is complete, geographic data settings are updated for the QRadar deployment.
Node maxmind license key#
Update the User ID and License Key values from Step 5.
The DevOps team for your QRadar on Cloud Console can enable geographic data for your deployment.
Important: If you are a QRadar on Cloud administrator, you must provide your User ID and License Key information in a QRadar Support case.
Important: If you exit the license key screen without recording the information, you must generate a new license key from Step 4.
Record the Account/User ID and License Key information.
Select Generate a license key and config file for geoipupdate versions older than 3.1.1.
In the field, ' Will this key be used for GeoIP Update', select Yes.
In the License key description, type: QRadar License Key.
After you assign an account password, use the credentials you created to sign in.
After your account is created, an email is provided by MaxMind.
Important: If you are a QRadar on Cloud administrator, you must provide your User ID and License Key information in a QRadar Support case. This procedure is for QRadar versions 7.3.1 and later. This procedure requires an Admin user to create a MaxMind account and update System Settings to ensure that geographic location data updates can complete successfully. Configuring a MaxMind account for geographic data updates
Advanced search (GEO::LOOKUP or GEO::DISTANCE)Ģ.
Flag icons to designate the country or region of an IP address.
IP address hover menus in the user interface.
For example, create an offense when an authentication occurs from an unusual location or more than 50 miles from an office location. Geographic data also allows users to create searches or rules when events or flows occur outside or within a geographic range. Geographic data allows administrators to not only show the location of a host related to an event, flow, or offense, but to also define the location of your network assets. Geographic data (geodata) in QRadar is used to associate an IP address from the user interface to display a visual flag indicator or map overview to users. Geodata makes the source or destination for the IP address associated to an event, flow, or offense more easily understood than just displaying an IP address.
0 kommentar(er)
