IBM
C1000-163 · Question #2
What does it mean when a custom rule is partially matched in QRadar?
The correct answer is D. Not all the the tests in the rule were fully matched. See the full explanation below for the reasoning.
Question
What does it mean when a custom rule is partially matched in QRadar?
Options
- AThe rule is not fully enabled.
- BThe AND NOT operator is set incorrectly in the first test.
- CAll the tests in the rule were fully matched.
- DNot all the the tests in the rule were fully matched.
How the community answered
(28 responses)- A4% (1)
- B4% (1)
- C11% (3)
- D82% (23)
Community Discussion
No community discussion yet for this question.