Mapping closing reason priority
You can map QRadar® offense closing reasons to the suggested AI priority evaluation choices in QRadar Advisor with Watson™ to automate the AI feedback collection.
Before you begin
You must have QRadar administrator privileges to map closing reasons.
About this task
Note: This feature is available in V2.5.2 and later.
The Closing Reason Priority Mapping configuration page lists all the closing reasons that are defined on your QRadar system. You can map each closing reason to High, Low, or I'm not sure. When you close an offense that has a mapped closing reason, it is sent as AI feedback. For example, the AI predicted offense ID "10" is low priority and you close it with a closing reason of "False Positive", which was mapped to "low," that is then sent as "I agree with Watson" automatically. Or if the AI predicted low, but you close it with a reason of "Escalated," which was mapped to "high", that is then sent as "No, I don't agree with Watson."
By automating the AI feedback collection, you do not have to click Agree or Don't agree on every offense after you mapped the closing reasons. However, if you do provide manual feedback, even if the closing reasons were mapped, the manual feedback you provide takes precedence.
Procedure
-
On the
navigation menu (
), click Admin.
- In the Apps section, under QRadar Advisor with Watson, click Configuration.
- Click Optional Settings to open the Optional Settings menu page.
- Click Closing Reason Priority Mapping.
- View the closing reason from your QRadar system and then select an
AI priority evaluation choice from the menu.
- Click Save mappings.