QUESTION: 45

What information is included in flow details but is not in event details?

Network summary information
Magnitude information
Number of bytes and packets transferred
Log source information

Answer(s): A

Explanation:

Flows represent network activity by normalizing IP addresses, ports, byte and packet counts, and other data, into flow records, which effectively are records of network sessions between two hosts.

Reference:

https://www.ibm.com/docs/en/qsip/7.3.2?topic=overview-qradar-events-flows

Reveal Solution Next Question

QUESTION: 46

How can an analyst search for all events that include the keyword 'vims'?

By going to the Network Activity tab and run a quick search with the 'virus' keyword.
By going to the Log Activity tab and run a quick search with the 'virus' keyword.
By going to the Offenses tab and run a quick search with the 'virus' keyword.
By going to the Log Activity tab and run this AQL: select * from events where eventname like "virus'

Answer(s): D

Reveal Solution Next Question

QUESTION: 47

What steps are needed to add an Annotation to an event or flow that triggered a Rule?

When creating a Rule, a custom Annotation can be automatically applied to events and flows that originate from specified Sources.
Events and Flows cannot be Annotated, the only information allowed in an event or flow is data that was included in the original payload.
When creating a Rule, a custom Annotation can be specified to automatically be applied to the event or flow that triggered the Rule.
Annotations can be manually added to an Offense. These Annotations are then automatically applied to all events or flows which triggered the rule creating that Offense.

Answer(s): C

Reveal Solution Next Question

QUESTION: 48

An analyst wants to find all events where Process name includes reference to exe files. Which quick search will return the expected result?

(Process name) AND /.*exe/
/Process name/AND (/exe) )
/Process name/ AND /.*exe/
"Process name" AND "*exe"

Answer(s): B

Reveal Solution Next Question

Free C1000-018 Exam Braindumps (page: 12)

QUESTION: 45

Explanation:

Reference:

QUESTION: 46

QUESTION: 47

QUESTION: 48