When will events or flows stop contributing to an offense?

The correct answer is A. When the offense becomes dormant. In IBM QRadar SIEM V7.5, events or flows stop contributing to an offense when the offense becomes dormant. Here's how it works: Dormant Offense: An offense becomes dormant when there is no new activity contributing to it for a specified period. This indicates that the threat or…

Rule and Offense Management

Question

Options

AWhen the offense becomes dormant
BWhen the offense becomes inactive
CAfter the offense is assigned to an analyst
DWhen you protect the offense

How the community answered

(25 responses)

A
92% (23)
B
4% (1)
D
4% (1)

Explanation

In IBM QRadar SIEM V7.5, events or flows stop contributing to an offense when the offense becomes dormant. Here's how it works: Dormant Offense: An offense becomes dormant when there is no new activity contributing to it for a specified period. This indicates that the threat or incident has not had any further related events Contribution Stoppage: Once an offense is marked as dormant, no additional events or flows are added to it, which helps in managing the offense lifecycle and resources within QRadar. This behavior helps in distinguishing between active and inactive threats, allowing security analysts to focus on ongoing incidents.

Topics

#offense lifecycle#dormant offense#event contribution

Community Discussion

No community discussion yet for this question.

Full C1000-156 Practice