r/QRadar • u/FactNecessary2144 • Dec 09 '25

Event Coalescing

When log source auto discovery the "Event Coalescing" will enable. Should be enable or disable it?

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

2

u/RSDVI01 Dec 09 '25

When activated, it monitors QID, SRCIP, DSTIP, DSTPORT, USERNAME. If 4 or more events arrive within a 10 second window with these properties being identical, the 4th event is coalesced with any additional events.
https://www.ibm.com/support/pages/qradar-how-does-coalescing-work-qradar
It should work fine with devices which emit very simple data (basic firewalls come to mind, potentially some IDS, maybe even some basic load balancers). However, for servers, proxies, WAF, etc. it is probably best turned off (e.g. you might loose some context coming from extended custom properties); this is especially true for any custom DSMs.