How can an administrator configure a rule response to add event data to a reference set?

The correct answer is D. Use the "add to reference set" rule response. Administrators can configure a rule response in QRadar to add event data to a reference set by using the "add to reference set" rule response. This is a predefined response action in QRadar that allows specific event data to be added to a reference set when the rule conditions…

Rule and Offense Management

Question

Options

AWrite a custom script.
BUse AQL functions.
CUse the "add the following data to a reference set" rule test.
DUse the "add to reference set" rule response.

How the community answered

(30 responses)

B
7% (2)
C
3% (1)
D
90% (27)

Explanation

Administrators can configure a rule response in QRadar to add event data to a reference set by using the "add to reference set" rule response. This is a predefined response action in QRadar that allows specific event data to be added to a reference set when the rule conditions are met. Navigate to the "Offenses" tab in the QRadar console. Select "Rules" from the navigation pane. Create a new rule or edit an existing rule. In the "Rule Response" section, add a new response. Select the "Add to Reference Set" response. Specify the reference set and the data to be added. Save and deploy the rule.

Topics

#rule response#reference set#event data#rule configuration

Community Discussion

No community discussion yet for this question.

Full C1000-156 Practice