What is an approach to tuning a "noisy" rule, that is, a rule that generates too many offenses?

Question

Options

• ADetermine whether the rule matches too many conditions in the traffic.
• BIn the offense output, scroll down and review the "Excessive" flags.
• CConfirm that the rule is enabled.
• DUse the QRadar Pulse app to map noisy offense output.

• A
  85% (33)
• B
  3% (1)
• C
  8% (3)
• D
  5% (2)

No community discussion yet for this question.