An analyst needs to investigate why an Offense was created. How can the analyst investigate? A. Review the Offense summary to investigate the flow and event details. B. Review the X-Force rules to investigate the Offense flow and event details.…
What are the different flow types in QRadar? A. L2L, L2R, R2R, R2L B. Standard, Type A, Type B, Type C C. Standard, Type 1, Type2, Type 3 D. Type 1, Type 2, Type 3, Type 4
What is a valid offense naming mechanism? This information should: A. set the naming of the associated offense(s). B. set or replace the naming of the associated offense(s). C. replace the naming of the associated offense(s). D. be included in…
An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an ‘exe’ file during a certain time period. How can the analyst do this? A. On the Search bar select Quick Filter,…
An analyst wants to view information about repeated offenders and IP addresses that generate many attacks or are subject to many attacks. What should the analyst choose from the navigation options in the Offense tab? A. By Event Category or…
What is the procedure to re-open a closed Offense? A. A closed Offense cannot be re-opened. B. Wait for new events/flows that will re-open the closed Offense. C. Activate the Offense in the action/re-open drop down menu of the Offense…
An analyst needs to use a new custom property in a rule. What must be the mandatory characteristic of the custom property? A. It must be shared. B. It must be boolean. C. It must be stored. D. It must…
Which are the supported protocol configurations for Check Point integration with QRadar? (Choose two.) A. CHECKPOINT REST API B. SYSLOG C. JDBC D. SFTP E. OPSEC/LEA
What information is displayed in the default “Log Activity” page? (Choose two.) A. QID B. Protocol C. Qmap D. Log Source E. Event Name
An analyst needs to find events coming from unparsed log sources in the Log Activity tab. What is the log source type of unparsed events? A. SIM Generic B. SIM Unparsed C. SIM Error D. SIM Unknown