Managing policies
You can create allowlist and blocklist policies in QRadar® EDR that are not linked with alerts. You can also activate preexisting protection policies on your endpoints through the QRadar EDR Agent, and create custom detection strategy policies.
Policies
QRadar EDR has four types of policies.
- Allowlist
- Use an allowlist policy to specify false positives and behavior for which you don't want to receive an alert. An allowlist policy can override a protection policy.
- Blocklist
- Use a blocklist policy to either automatically block processes or automatically create an alert for a process. Blocklist policies have the highest priority. Other policies cannot override a blocklist policy.
- Protection
- When a protection policy is enabled, the QRadar EDR Agent switches from EDR mode to EPP mode and automatically blocks any process that triggers the policy. When the agent blocks a process, it creates an alert. An allowlist policy can override a protection policy.
- DeStra
- Detection strategy (DeStra) policies are custom policies that you create based on information that is gathered from events that are collected by the QRadar EDR Agent. DeStra policies use LUA scripts and run at the endpoint level. DeStra policies are supported on Linux®, macOS, and Windows.
QRadar EDR includes some allowlist, blocklist, and protection policies. You can create your own allowlist, blocklist, and detection strategy policies.