The IBM QRadar Server Discovery function is designed to automatically identify servers and their roles (e.g., web server, mail server, DNS server) on a network. This process involves analyzing network traffic and other data sources. All the information gathered about these discovered servers, including their services, open ports, and server classification, is populated into and stored within the Asset Profile Database. This database acts as the central repository for comprehensive information about all known assets on the network, which is essential for correlation rules, reporting, and incident investigation.

A. Flow profile database: The flow database stores raw network session data (flows), which is a source for discovery, but it is not the profile database where consolidated asset and server information is stored.

B. Network profile database: This is a generic term. The specific and correct name for the database that stores host and server information in QRadar is the Asset Profile Database.

C. Domain profile database: This database stores information related to network domains and their assets. While related, it is a component of the broader Asset Profile Database, which is the primary answer.

1. IBM QRadar SIEM Documentation, "Server discovery": "IBM QRadar automatically discovers servers on your network and adds them to the asset profile database. QRadar uses passive flow data and vulnerability data to identify servers on your network."

Source: IBM QRadar SIEM Documentation, Section: Asset profiles, Subsection: Server discovery.

2. IBM QRadar SIEM Documentation, "Asset profile overview": "The asset profile database is populated by identity information that is learned from event and flow data... QRadar automatically discovers servers on your network and adds them to the asset profile database."

Source: IBM QRadar SIEM Documentation, Section: Asset profiles, Subsection: Asset profile overview.