In a single domain QRadar deployment, which IP addresses are considered local?

In a single domain QRadar deployment, the IP addresses considered local are those that are defined in the network hierarchy. Here is a detailed explanation:

Network Hierarchy: QRadar uses a network hierarchy to define and manage IP addresses within the organization. This hierarchy allows QRadar to understand which IP addresses are part of the internal network and which are external.

Defining Local IP Addresses: Any IP address that is specified within the network hierarchy is considered local. This includes all the subnets and IP ranges that are part of the internal network.

Purpose: By defining the network hierarchy, QRadar can effectively differentiate between internal (local) and external (non-local) traffic, enabling more accurate detection and correlation of security events.

This approach helps in identifying suspicious activities by comparing the source and destination of traffic against the defined internal network.

ReferencesIBM Security QRadar SIEM and IBM Security QRadar EDR integration.pdf​