A ORadar administrator is trying to tune a rule so that it cannot send an email more than 10 times in a 24-hour period. Which method can be used to accomplish this goal?

The correct answer is B. Using the "response limiter". To ensure that a rule in IBM QRadar SIEM V7.5 does not send an email more than 10 times in a 24- hour period, the "response limiter" can be used. Here's how it works: Response Limiter: This feature limits the number of times a rule action (such as sending an email) can be…

Rule and Offense Management

Question

Options

AUsing a special rule test that limits the number of rule triggers
BUsing the "response limiter"
CTuning the rule conditions to make it trigger fewer times
DUsing the "execute custom action" rule response

How the community answered

(20 responses)

A
5% (1)
B
90% (18)
D
5% (1)

Explanation

To ensure that a rule in IBM QRadar SIEM V7.5 does not send an email more than 10 times in a 24- hour period, the "response limiter" can be used. Here's how it works: Response Limiter: This feature limits the number of times a rule action (such as sending an email) can be executed within a specified timeframe. Configuration: Set the response limiter to a maximum of 10 actions in 24 hours. Implementation: Apply the response limiter to the rule, ensuring that even if the rule conditions are met multiple times, the email will only be sent up to the specified limit.

Topics

#response limiter#rule tuning#email notifications#rule responses

Community Discussion

No community discussion yet for this question.

Full C1000-156 Practice