Once a QID is created how is it associated with an event?

Question

Options

• AThe user manually maps it.
• BIt is automatically assigned.
• CThe network hierarchy maps it.
• DIt is specified when the QID is created.

• A
  78% (14)
• B
  11% (2)
• C
  6% (1)
• D
  6% (1)

Explanation

Option A is correct because in QRadar, after a custom QID is created, an administrator must manually map it to specific log source events through the event categorization or log source management interface - the system has no way to automatically know which incoming events should be associated with a newly created QID.

Option B is wrong because automatic assignment only applies to QIDs that QRadar already recognizes from its built-in DSM (Device Support Module) parsing; newly created custom QIDs require explicit human action to link them to events. Option C is wrong because the network hierarchy in QRadar governs asset and network organization, not the mapping of events to QIDs. Option D is wrong because the QID creation process only defines the identifier's properties (name, category, severity, etc.) - event association is a separate subsequent step, not part of creation itself.

Memory tip: Think of a QID like a new file folder you've just labeled - creating the folder doesn't automatically put papers in it. You (the user) have to manually file the documents (events) into it yourself.

No community discussion yet for this question.