From which tabs can a QRadar custom rule be created?

Question

Options

• AOffenses or Log Activity tabs
• BOffenses, Log Activity or Network Activity tabs
• CLog Activity or Network Activity tabs
• DOffenses or Admin tabs

• A
  5% (2)
• B
  79% (30)
• C
  13% (5)
• D
  3% (1)

Explanation

Option B is correct because QRadar's Rules Wizard can be launched from three distinct tabs - Offenses, Log Activity, and Network Activity - allowing analysts to create custom rules in the context most relevant to what they are investigating (offenses, events, or flows respectively).

Option A (Offenses or Log Activity only) is wrong because it excludes the Network Activity tab, which also supports rule creation for flow-based detection. Option C (Log Activity or Network Activity only) incorrectly drops the Offenses tab, which is a valid starting point for rule creation. Option D (Offenses or Admin) is the most misleading distractor - while the Admin tab is where all existing rules are managed, it is not one of the three tabs where the Rules Wizard is directly accessible for creating new rules in context.

Memory tip: Think "O-LA-NA" - Offenses, Log Activity, Network Activity - three places you can see suspicious activity are the same three places you can act on it by creating a rule.

No community discussion yet for this question.