How can an analyst search for all events that include the keyword 'access'?

Question

Options

• AGo to the Log Activity tab and run this AQL: select * from events where eventname like 'access'.
• BGo to the Offenses tab and run a quick search with the 'access' keyword.
• CGo to the Network Activity tab and run a quick search with the 'access' keyword.
• DGo to the Log Activity tab and run a quick search with the 'access' keyword.

• A
  6% (2)
• B
  13% (4)
• C
  3% (1)
• D
  77% (24)

Explanation

Option D is correct because in IBM QRadar, the Log Activity tab is the dedicated interface for viewing and searching event logs, and the Quick Search feature allows analysts to filter all events containing a specific keyword like 'access' across multiple fields simultaneously - making it the fastest and most straightforward method.

Option A is wrong on two counts: the AQL query eventname like 'access' only searches the event name field (not all fields), and like without wildcards (%) would require an exact match rather than a substring match - neither of which finds all events containing 'access'.

Option B is wrong because the Offenses tab is used to investigate correlated offenses and alerts, not to search raw event logs.

Option C is wrong because the Network Activity tab deals with network flows (connection data), not events - searching there would miss log-based events entirely.

Memory tip: Think "Log Activity = Log Events" - anything involving searching raw event/log data belongs on the Log Activity tab. If a question asks about searching flows, that's Network Activity; if it's about correlated incidents, that's Offenses.

No community discussion yet for this question.