Complete newbie here - what are the biggest pitfalls to avoid in the first month?

First month with QRadar is all about setup and data. Biggest pitfall is ingesting too much, too fast, and getting swamped.

Focus on:
* Getting your log sources right. Start with critical systems only (firewalls, AD). Validate events are parsing correctly.
* Tuning out the noise immediately. You'll get flooded with false positives. Create low-level rules to suppress irrelevant events from the start.
* Don't touch default rules/content packs. Clone them first, then modify. You will break things.
* Storage. Calculate your EPS (Events Per Second) and license accordingly, but know that your estimates will be wrong. Plan to review after week one.

Biggest cost mistake is not matching your license tier to your actual EPS. Overages hurt.