You want to use a quick filter search to look for certain elements: - 10.100.100.* - BlueCoat - TCP_REFRESH_MIS Which string provides the correct results?

The correct answer is C. "10.100.100.*%AND%Bluecoat%AND%TCP_REFRESH_MIS". In IBM QRadar SIEM V7.5, using a quick filter search requires the correct syntax to find specific elements within the event logs. The correct string to search for the elements 10.100.100., Bluecoat, and TCP_REFRESH_MIS is: String Structure…

Event and Flow Management

Question

You want to use a quick filter search to look for certain elements:

10.100.100.*
BlueCoat
TCP_REFRESH_MIS

Which string provides the correct results?

Options

A(10.100.100.- Bluecoat TCP_REFRESH_MIS)
B10.100.100.*%Bluecoat%TCP_REFRESH_MIS
C"10.100.100.*%AND%Bluecoat%AND%TCP_REFRESH_MIS"
D(10.100.100/ AND Bluecoat AND TCP_REFRESH_MIS)

How the community answered

(49 responses)

A
14% (7)
B
4% (2)
C
76% (37)
D
6% (3)

Explanation

In IBM QRadar SIEM V7.5, using a quick filter search requires the correct syntax to find specific elements within the event logs. The correct string to search for the elements 10.100.100., Bluecoat, and TCP_REFRESH_MIS is: String Structure: "10.100.100.%AND%Bluecoat%AND%TCP_REFRESH_MIS" Elements: This string combines the IP address pattern, device type, and specific event message using %AND% to ensure that all three elements are included in the search results. Quotation Marks: The quotation marks are necessary to group the search terms and ensure that the search engine interprets them correctly.

Topics

#quick filter#search syntax#wildcard search#AQL

Community Discussion

No community discussion yet for this question.

Full C1000-156 Practice