QUESTION: 25

A custom rule is generating events reporting that a specific user is failing to login too many times in the last 5 minutes. The administrator opens the event details to investigate the anomaly associated with the events but finds that no Anomaly details pane is shown.

What is the reason?

The events were generated by:

a Behavioral Detection Rule
an Anomaly Detection Rule
a Threshold Detection Rule
a standard Custom Rule

Answer(s): B

Reference:

http://www.siem.su/docs/ibm/Administration_and_introduction/User_Guide.pdf

Reveal Solution Next Question

QUESTION: 26

An administrator may be asked to collect diagnostic information on one of our main services. For example, ecs- ec.

Commands such as:
/opt/qradar/support/thredtop.sh
/opt/qradar/support/jmx.sh

These commands collect thread and statistical information on the Services pipeline, queues and filters. How would an administrator identify a list of jmx ports for each service?