Platform health
QRadar deployment checks: Console connection and version, managed hosts, EPS licence usage, log-source status, ingest freshness, offense backlog, auto-discovered log sources, each with a verdict; the paid AI reading ties the failing ones together and says what to fix first.
Platform health looks at the QRadar deployment that carries the logs. Opening the page runs one round of checks (free, read-only probes); the "AI reading" is paid (platform-ops copilot).
Overview
A one-line verdict (healthy / items to watch / issues found / some checks unavailable) and three cards: passed, needs work (fail + warn), unavailable (permission missing or API not reachable).
Checks
Grouped as needs work / passed / unavailable, one row each: verdict, what was checked, the actual value, why it was judged so. The seven checks:
| Check | Looks at | Threshold |
|---|---|---|
| Console connection and version | /api/system/about reachable, version ≥ 7.4 | Below 7.4 warns |
| Managed hosts | Status of each host in /api/config/deployment/hosts | Any host not Active fails |
| EPS licence usage | average_eps / eps_allocation per host | ≥ 85% warns, ≥ 100% fails (RST_PLATFORM_EPS_WARN_PCT / _FAIL_PCT) |
| Log-source status | Enabled log sources in Error / Disconnected | Any fails; no enabled source at all warns |
| Ingest freshness | Age of last_event_time on enabled sources | 6 h warns, 24 h fails (RST_PLATFORM_STALE_WARN_H / _FAIL_H) |
| Offense backlog | OPEN offenses, those older than 7 days, unassigned ones | ≥ 200 warns, ≥ 800 fails (RST_PLATFORM_OFFENSE_WARN / _FAIL); age from RST_PLATFORM_OFFENSE_OLD_DAYS |
| Auto-discovered log sources | Auto-discovered sources typed Unknown / Generic | Any warns: the DSM did not match and events parse generically |
"Unavailable" is not an error: without deployment-management rights on the token's role, managed hosts and EPS licence cannot run; add the rights and re-run. The other five need only Ariel / Offenses / log-source rights.
AI reading
Paid capability (platform-ops copilot), Standard tier (including the 14-day trial) and up. The checks themselves are free.
"AI reading" appears when something is not passing. The model reads the failing checks together: which share a root cause (a saturated EPS licence and Disconnected log sources are often one problem), what to fix first, and how, down to the QRadar page (Admin → System and License Management, Log Sources, Deploy Changes).
Relation to other pages
- "Platform issues" on Security posture is this page's count of non-passing checks; "Log sources at risk" is the union of the status and freshness checks.
- The tabs on top also hold Audit log and Outbound channels.
Reports
Daily / weekly / monthly: offense posture, top rules and entities, analysis activity, log-source health, model usage and health. Scheduled generation, archive and push.
Settings
Admin configuration: QRadar Console connection, log-source whitelist, masking mode, audit and forwarding, online update. Changes apply at once.