A company has two different domains in their IBM QRadar system: Domain_A and Domain_B. An administrator has been tasked to create a rule to look only at events that are tagged with Domain_A and…

Question

Options

• Ais from domain: Domain_A
• Bfrom domain: Domain_A
• Cdomain is: Domain_A
• Ddomain is one of: Domain_A

• A
  4% (2)
• B
  6% (3)
• C
  9% (5)
• D
  81% (44)

Explanation

In IBM QRadar's rule creation interface, the correct syntax for filtering events by domain uses the condition "domain is one of: Domain_A" - this is the exact phrasing QRadar uses in the Rule Wizard when specifying domain-based conditions, and "one of" allows for proper set-membership matching even when only a single domain is specified. Option A is wrong because "is from domain" is not valid QRadar rule syntax. Option B omits the verb entirely, making it grammatically and syntactically invalid in QRadar's condition builder. Option C uses "domain is:" which is closer but still incorrect - QRadar does not use bare "is" for domain matching; it uses the "is one of" construct to support both single and multi-domain selection. A helpful memory tip: think of QRadar domain conditions like a SQL IN clause - "is one of" is always the pattern, even for a single value, because the field accepts a list.

No community discussion yet for this question.