Rule performance visualization
Rule performance visualization extends the current logging around performance degradation and the expensive custom rules in the QRadar® pipeline. With rule performance visualization, you can easily determine the efficiency of rules in the QRadar pipeline, directly from the Rules page.
![Performance column on the Rules page](performance_column.jpg)
When events or flows are routed to storage, QRadar begins collecting metrics on enabled rules for efficiency measures. Metrics are collected on all event, common, and flow rules. When you save rule updates, the metrics are cleared for the rules that you updated to avoid any confusion around performance and updated rules. This option is configurable by an Administrator.
You can sort rules by their performance metrics and identify the more expensive rules. When you review the rules, you can adjust the tests to optimize each rule, and reduce the load on the system.
With rule performance visualization, you see how expensive the rules are. QRadar operations teams can monitor any expensive rules and ensure that they do not cause future performance issues.
By having rules run efficiently, the workload on the system can decrease. Over time, this efficiency can help QRadar avoid any performance degradations around rules, which cause rules to bypass rule correlation. As a result, potential suspect activity might not trigger a notification, potentially missing future security-related issues.
For more information about tuning rules, see the IBM QRadar Tuning Guide.
View the metrics for a rule
You can view the metrics for a rule from the Rules page when you move the mouse pointer over the colored bars in the Performance column, and in the Performance Analysis textbox, which is in the lower-right corner of the Rules page. You can also view the metrics for a rule in the Rule Wizard when you edit a rule. The timestamp in the Performance Analysis textbox shows when the metrics for the rule were updated. For more information about creating rules, see the Rules topic.
![Performance Analysis on the Rules page](rules_page.jpg)
![Performance Analysis in the Rule Wizard](rule_wizard.jpg)
Colors and bars in the Performance column on the Rules page
- One red bar
- The rule is under-performing and needs to be tuned. The EPS/FPS throughput for this rule is below the lower limit. Open the rule and tune the tests.
- Two orange bars
- The rule might need some tuning.
- Three green bars
- The rule has a high throughput above the upper limit of the EPS/FPS threshold.
![Custom Rule Settings in QRadar](custom_rule_default_settings.jpg)
For more information about tuning rules, see Custom rule testing order.