IBM
C1000-163 · Question #7
An analyst reviewed an active offense that was many attackers, generating many events in the same category, targeting many systems. Upon further analysis, the analyst determined that the traffic…
The correct answer is C. Edit building blocks by using the Custom Rules Editor to tune the category. See the full explanation below for the reasoning.
Question
An analyst reviewed an active offense that was many attackers, generating many events in the same category, targeting many systems. Upon further analysis, the analyst determined that the traffic from the attackers is legitimate and should not contribute to the offenses. Which tuning methodology guideline can the analyst use to tune out this traffic?
Options
- AEdit the building blocks by using the Custom Rules Editor to tune the specific event.
- BUse the Log Source Management app to tune the category.
- CEdit building blocks by using the Custom Rules Editor to tune the category.
- DUse the False Positive Wizard to tune the specific event.
How the community answered
(42 responses)- A10% (4)
- B5% (2)
- C83% (35)
- D2% (1)
Community Discussion
No community discussion yet for this question.