An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action. What column in the list of Offenses should the administrator use to prioritize them?

Question

Options

• AMagnitude
• BOffense Type
• CSource IPs
• DLast Event/Flow

• A
  77% (24)
• B
  13% (4)
• C
  3% (1)
• D
  6% (2)

Explanation

Magnitude is the correct prioritization column because it is a composite score (0–10) that QRadar calculates by combining three weighted factors: relevance (how much the offense impacts your network), severity (the attack's potential damage), and credibility (confidence in the data source). It is purpose-built to answer "which offense needs attention first," making it the ideal triage tool when facing a large queue.

Why the distractors fall short:

• B. Offense Type classifies what kind of attack occurred (e.g., policy violation, exploit), but two offenses of the same type can differ wildly in urgency.
• C. Source IPs identifies where the attack originated, which is useful for investigation but doesn't indicate how serious or credible the offense is.
• D. Last Event/Flow shows recency, which can be misleading - a very recent but low-severity offense should rank below an older, critical one.

Memory tip: Think of Magnitude as QRadar's "threat GPA" - just as a GPA rolls multiple grades into one number for quick comparison, Magnitude rolls relevance + severity + credibility into a single score so you can sort and act without reading every detail first.

No community discussion yet for this question.