Revision as of 12:34, 24 March 2025

Principais arquivos

A instalação padrão fica no diretório:

/opt/qradar/
|- bin/
|  |- ariel_query                     -> Run a Ariel query from command line.
|  |- apply_appliance_tunings.pl      -> Apply Appliance Tunings settings
|  |- logrun.pl                       -> Send logs to qradar
|  |- qchange_netsetup                -> Realiza a troca de IP, DNS, ...
|- conf/
|  |- nva.conf                        -> Um dos principais arquivos e configuração do QRadar 
|- support
|  |- qappmanager                     -> verify status of all apps
|  |- recon                           -> Conecta ao container rodando a aplicação "recon connect <id>"
|  |- threadTop.sh                    -> thread like Top command, para aplicativos do QRadar
|- upgrade
|  |- util                     
|  |  |- setup
|  |  |  |- upgrades
|  |  |  |  |- do_deploy.pl           -> deploy events for 
|- conf
/store                                -> is used as directory for DB, Config. deployment files, and all stored events and flows data.

QRadar: Core services and the impact of restarting services

Commands

Run a command in all QRadar servers

/opt/qradar/support/all_servers.sh -k df -h /root /var/log | tee diskcheck.txt

ariel_query

Run a aql directly from command line

ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"

Ver também

@@ Line 26: / Line 26: @@
 == Commands ==
+=== Run a command in all QRadar servers ===
+ '''/opt/qradar/support/all_servers.sh -k''' df -h /root /var/log | tee diskcheck.txt
 === ariel_query ===
+Run a aql directly from command line
   ariel_query --no-verify -u admin --output table --query "select QIDNAME(QID) from EVENTS limit 10"