IBM
C1000-163 · Question #96
A QRadar analyst was asked to provide a selection of events for further investigation by somebody who does not have access to the QRadar system. Which of these approaches provides an accurate copy…
The correct answer is C. By using the Log Activity tab, filter the events until only those that you require are shown. Then. See the full explanation below for the reasoning.
Question
A QRadar analyst was asked to provide a selection of events for further investigation by somebody who does not have access to the QRadar system. Which of these approaches provides an accurate copy of the required data in a readable format?
Options
- ABy using the Advanced Search option in the Log Activity tab, run an AQL command:
- BBy using the "Event Export (with AQL)" option in the Log Activity tab, test your query with the Test
- CBy using the Log Activity tab, filter the events until only those that you require are shown. Then,
- DLog in to the Command Line Interface and use the ACP tool (/opt/qradar/bin/runjava.sh
How the community answered
(17 responses)- A6% (1)
- B18% (3)
- C71% (12)
- D6% (1)
Community Discussion
No community discussion yet for this question.