Offline IBM QRadar SIEM Deployment

- Install IBM QRadar SIEM as software on RHEL virtual machines (KVM): Console, Event and Flow Processor, Data Node, Flow Collector, App Host and Event Collectors.
- Configure high availability at the main site and a passive DR site with the QRadar Data Synchronization app.
- Move /store to external iSCSI storage and set up NFS archival and retention.
- Install QRadar Network Insights (NDR) on physical servers and validate flows from SPAN/TAP feeds.
- Install QRadar SOAR, link it to QRadar and build incident-response playbooks. Integrate SOAR with the ITSM tool.
- Install and tune UEBA, Use Case Manager, Pulse dashboards and Analyst Workflow.
- Onboard log sources: firewalls, switches, servers, Active Directory, endpoints and applications. Write custom DSMs and parsers where needed.
- Build correlation rules, reference sets, dashboards and reports mapped to MITRE ATT&CK.
- Run HA and DR failover tests and UAT, and prepare the LLD, runbooks and test evidence.
- Train the operations team and hand over.

The platform is sized for about 10,000 EPS with one year of online retention. The network has no internet access, so all installation and updates are done offline.