QUESTION: 5

An analyst has been assigned a task to modify a rule in such a manner that Source IP of the triggered Offense from this rule should be stored in a Reference set.
Under which section of the rule wizard can the analyst achieve this?

Rule Response
Rule Action
Rule Test Stack Editor
Rule Response Limiter

Answer(s): C

Reveal Solution Next Question

QUESTION: 6

An analyst for a particular offense needs to investigate to understand the breakdown of the offense details. How can the analyst do this?

Look at the magnitude information and its breakdown.
View the attack path of the offense.
Look at all the event QIDs attached to the offense.
Look at the list of categories, event low level categories and the events attached.

Answer(s): A

Reference:

https://www.ibm.com/docs/en/qradar-on-cloud?topic=offenses-offense-investigation

Reveal Solution Next Question

QUESTION: 7

Which QRadar timestamp specifies when the event was received from the log source?

Collect time
Start time
Storage time
Log Source time

Answer(s): B

Reference:

https://www.ibm.com/mysupport/s/question/0D50z00006PEG2mCAH/why-do-i-see-different-time-stamps-for-qradar-events?language=en_US

Reveal Solution Next Question

QUESTION: 8

An analyst notices that there are a number of invalid Offenses being created from a network node. This node has been determined to be in Domain 2 and has the following log sources sending it events: (3Com 8800 Series Switch from 172.18.1.1, Cisco ACE Firewall from 172.18.1.2, FireEye from 172.18.1.3, and Palo Alto PA Series from 172.18.1.8).

The analyst should create a False Positive Building Block that has a filter:

"when the destination IP is in 172.18.0.0/16"
"when the local network is Domain 2 and when the source IP is in 172.18.0.0/16"
"when the remote IP is one of the following 172.18.1.1, 172.18.1.2. 1.3 172. 18.18.1.8
"when the local network is Domain 2 and when the source IP is in 172.18.0.0/16"

Answer(s): D

Reveal Solution Next Question

Free C1000-018 Exam Braindumps (page: 3)

QUESTION: 5

QUESTION: 6

Reference:

QUESTION: 7

Reference:

QUESTION: 8

C1000-018 Exam Discussions & Posts