An administrator receives an expensive custom rule notification. Which tool can now be enabled via the Advanced `System Settings' ?Custom Rule Settings to help troubleshoot this?

Question

Options

• AOffense Analysis
• BRule Analysis
• CCustom Rule Analysis
• DPerformance Analysis

• A
  3% (1)
• B
  8% (3)
• C
  74% (29)
• D
  15% (6)

Explanation

Custom Rule Analysis is the specific tool IBM QRadar exposes under Advanced System Settings > Custom Rule Settings precisely because it is designed to diagnose "expensive" rule notifications - it profiles the flagged rule's resource consumption and execution patterns so the administrator can tune or disable it.

Why the distractors are wrong:

• A. Offense Analysis - focuses on investigating generated offenses/alerts, not on diagnosing rule engine performance.
• B. Rule Analysis - not a named tool in QRadar's Custom Rule Settings menu; it is a plausible-sounding distractor but does not exist as a distinct option there.
• D. Performance Analysis - a generic concept; QRadar does have performance monitoring, but it is not what is surfaced specifically within the Custom Rule Settings path.

Memory tip: Match the notification to the tool - you got an "expensive custom rule" warning, so you enable "Custom Rule Analysis." The word "custom" appears in both the problem and the solution, making it the natural pairing on exam day.

No community discussion yet for this question.